Overview

overview

10

Static

static

10

2026-08-08...op.exe

windows10-2004-x64

9

2026-08-08...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    81s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 11:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_96eb70288c2608c5d1a1e66e69b93c86_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.3MB
  • Sample260808-nrb24aem7x
  • SHA256 e7d689d7c91db746face0f76c569910999fa73ceed05770f808aba7f550326ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  • Drops file in System32 directory 41 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_96eb70288c2608c5d1a1e66e69b93c86_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_96eb70288c2608c5d1a1e66e69b93c86_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:7000
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:3668
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:7016
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2000 -prefsLen 27098 -prefMapHandle 2004 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {a7ee4084-4726-44ed-a444-9d9abb26646a} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:6096
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27134 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {b93a691d-2ef0-46cb-90c8-9fa5ff1bca63} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            PID:6116
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3892 -prefsLen 25164 -prefMapHandle 3896 -prefMapSize 270279 -jsInitHandle 3900 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3904 -initialChannelId {818b0d64-6edd-4f0c-ae41-27bdbd6871ee} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5912
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4084 -prefsLen 27274 -prefMapHandle 4088 -prefMapSize 270279 -ipcHandle 4152 -initialChannelId {6aadabcf-5b3e-4943-9fd7-4ff84a47d2a3} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:5620
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2760 -prefsLen 34773 -prefMapHandle 2988 -prefMapSize 270279 -jsInitHandle 2992 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4464 -initialChannelId {617c13d1-e199-4912-b3db-d1f6faf49b43} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:4288
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 35010 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5096 -initialChannelId {6a348714-25cb-4d5f-971a-59ae8a33b608} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1492
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5308 -prefsLen 35010 -prefMapHandle 5312 -prefMapSize 270279 -ipcHandle 5320 -initialChannelId {49fe03fe-7148-4f04-a445-791f84d6d2d3} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5780
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32952 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2616 -initialChannelId {c26d731f-ef6e-4261-a75b-f736ea3d1df8} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:3312
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5824 -prefsLen 32952 -prefMapHandle 5828 -prefMapSize 270279 -jsInitHandle 5832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5840 -initialChannelId {095d5f6c-7c46-4b38-8b20-b23edb12b0e4} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5788
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2816 -prefsLen 32952 -prefMapHandle 2820 -prefMapSize 270279 -jsInitHandle 5604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5852 -initialChannelId {fe8cc842-9ba5-464c-af64-8c57a143a6cb} -parentPid 1140 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1140" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:4688
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5112
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2548
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4356
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2896
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" http://www.internetdownloadmanager.com/download2.html
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x30c,0x7ffce211c188,0x7ffce211c194,0x7ffce211c1a0
          3⤵
            PID:4764
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,4220120448145316194,6491110063803203992,262144 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
            3⤵
              PID:6960
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10762389613993487297,16044264945080779413,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
              3⤵
              • System Time Discovery
              PID:6476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,17876743921039917907,9557855310850255305,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
              3⤵
                PID:2540
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,9396291007124567482,1055863780542714819,2097152 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
                3⤵
                  PID:6976
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,190182239672706194,3047640148095430190,2097152 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                  3⤵
                    PID:6456
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5032,i,6341585933259997196,16156521302804232785,2097152 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
                    3⤵
                      PID:5852
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,1542413779155876714,2387976147518850412,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
                      3⤵
                        PID:5940
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,16224744903769320107,17168942096848650990,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
                        3⤵
                          PID:4444
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14262690397969786907,1139825606895502078,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
                          3⤵
                            PID:4924
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,14262690397969786907,1139825606895502078,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
                            3⤵
                              PID:4416
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6516,i,7082878156242841662,7604587554970338370,2097152 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
                              3⤵
                                PID:6496
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,2114901407175562903,3564276773818587078,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
                                3⤵
                                  PID:4356
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15410784997544490921,133952256973535185,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
                                  3⤵
                                    PID:2548
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,16789426654293994704,12458888705993519746,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
                                    3⤵
                                      PID:2896
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,9751893542003730502,11076258632407037911,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
                                      3⤵
                                        PID:6136
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4710310557803601392,8602435351502478092,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
                                        3⤵
                                          PID:4692
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14397739673867952211,12753836263241860371,524288 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:14
                                          3⤵
                                            PID:5372
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6672,i,8737463427539693152,1570036264609997745,262144 --field-trial-handle=2292,i,55014804827493291,11045143460462620644,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:10
                                            3⤵
                                              PID:5408
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b02
                                            2⤵
                                              PID:6864
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7000 -s 2060
                                              2⤵
                                              • Program crash
                                              PID:6492
                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Drops file in Program Files directory
                                            • Drops file in Windows directory
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:6268
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:5240
                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            PID:2540
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                            1⤵
                                              PID:1160
                                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                              1⤵
                                              • Executes dropped EXE
                                              PID:5284
                                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4704
                                            • C:\Windows\SysWow64\perfhost.exe
                                              C:\Windows\SysWow64\perfhost.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4816
                                            • C:\Windows\System32\ReFsDedupSvc.exe
                                              C:\Windows\System32\ReFsDedupSvc.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6216
                                            • C:\Windows\System32\SensorDataService.exe
                                              C:\Windows\System32\SensorDataService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Checks SCSI registry key(s)
                                              PID:5400
                                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4468
                                            • C:\Windows\system32\AgentService.exe
                                              C:\Windows\system32\AgentService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5448
                                            • C:\Windows\system32\SearchIndexer.exe
                                              C:\Windows\system32\SearchIndexer.exe /Embedding
                                              1⤵
                                              • Executes dropped EXE
                                              • Enumerates connected drives
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4804
                                              • C:\Windows\System32\SearchProtocolHost.exe
                                                "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                2⤵
                                                  PID:6688
                                                • C:\Windows\System32\SearchProtocolHost.exe
                                                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:2188
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:3796
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 1696 1660 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:7052
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                1⤵
                                                  PID:2960
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                  1⤵
                                                    PID:6456
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 7000 -ip 7000
                                                      2⤵
                                                        PID:3620
                                                    • C:\Windows\system32\verclsid.exe
                                                      "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                      1⤵
                                                      • System Binary Proxy Execution: Verclsid
                                                      PID:5960

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Reconnaissance

                                                          Resource Development

                                                          Initial Access

                                                          Execution

                                                          Persistence

                                                          Boot or Logon Autostart Execution

                                                          1
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          1
                                                          T1547.001

                                                          Browser Extensions

                                                          1
                                                          T1176

                                                          Privilege Escalation

                                                          Boot or Logon Autostart Execution

                                                          1
                                                          T1547

                                                          Registry Run Keys / Startup Folder

                                                          1
                                                          T1547.001

                                                          Defense Evasion

                                                          Modify Registry

                                                          3
                                                          T1112

                                                          System Binary Proxy Execution

                                                          1
                                                          T1218

                                                          Verclsid

                                                          1
                                                          T1218.012

                                                          Credential Access

                                                          Credentials from Password Stores

                                                          1
                                                          T1555

                                                          Credentials from Web Browsers

                                                          1
                                                          T1555.003

                                                          Unsecured Credentials

                                                          1
                                                          T1552

                                                          Credentials In Files

                                                          1
                                                          T1552.001

                                                          Discovery

                                                          Browser Information Discovery

                                                          1
                                                          T1217

                                                          Peripheral Device Discovery

                                                          2
                                                          T1120

                                                          Query Registry

                                                          5
                                                          T1012

                                                          System Information Discovery

                                                          6
                                                          T1082

                                                          System Location Discovery

                                                          1
                                                          T1614

                                                          System Language Discovery

                                                          1
                                                          T1614.001

                                                          System Time Discovery

                                                          1
                                                          T1124

                                                          Lateral Movement

                                                          Collection

                                                          Data from Local System

                                                          1
                                                          T1005

                                                          Command and Control

                                                          Exfiltration

                                                          Impact

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          elevation_service.exe
                                                          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          • Size 2.7MB
                                                          • SHA256 22af9fededbad765ba62d69d1cc78947a2c25aacce9ac96b9e84af61fe4daeeb
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          maintenanceservice.exe
                                                          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                          • Size 1.4MB
                                                          • SHA256 d8c4862f00769526c5f9e43baee3d334327e4d5511e5aec460a3d37859f78900
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          7z.exe
                                                          • Path C:\Program Files\7-Zip\7z.exe
                                                          • Size 1.7MB
                                                          • SHA256 147a36f3f714b6504ce4350b1aa0f0482260a0adaca2b53f08e0adc70ddfb1c0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          7zFM.exe
                                                          • Path C:\Program Files\7-Zip\7zFM.exe
                                                          • Size 1.5MB
                                                          • SHA256 5128ed80dc34a22832af92fa40804e7ff81ce8841d69548963abd5f397584f87
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          7zG.exe
                                                          • Path C:\Program Files\7-Zip\7zG.exe
                                                          • Size 1.2MB
                                                          • SHA256 1824e3c279b8bfb9490eb20e75faf82a3d9c7498f6d92b1eaa48fa772aaf0586
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Uninstall.exe
                                                          • Path C:\Program Files\7-Zip\Uninstall.exe
                                                          • Size 1.2MB
                                                          • SHA256 5b99747ee50bb0976fb1d862aaf71e2220faf012570496451a42c09639098f87
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          AppVShNotify.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                          • Size 1.4MB
                                                          • SHA256 e8bac58d853eed135bda6f29b59d197dd46d8550271d424e8d41c3276bed2504
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          IntegratedOffice.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                          • Size 4.6MB
                                                          • SHA256 734847181d743bf29935103d68791bc9758acf9fd71280d59e1afc18d412cd23
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          MavInject32.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                          • Size 1.5MB
                                                          • SHA256 c21c8a2c24a8140013637f184d7f9f2355543999196509ee844bc22eedb7dca2
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          OfficeC2RClient.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                          • Size 24.0MB
                                                          • SHA256 f4bb8de647a69ccad44988001c32464bdd2bd5eae49a8b24a994a2c0517ff105
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          appvcleaner.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                          • Size 2.7MB
                                                          • SHA256 948ba4fc0b37208c17a6a9b0ceb4f4f7b8d0b9ad09ab348677494f35a27df384
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          LICLUA.EXE
                                                          • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                          • Size 1.1MB
                                                          • SHA256 0b9d2749577349f3360456c4d3cbcd8de02a3499e6af2b8e53e90d6043f2e46f
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          OSE.EXE
                                                          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                          • Size 1.4MB
                                                          • SHA256 b0ebe9247ab3ccf252db7e0da4b2af1479754013ba8464d7aedd7fa22f329cf7
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          VSTOInstaller.exe
                                                          • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                          • Size 1.3MB
                                                          • SHA256 b6108652758914b1bcd53257d1417c61777ebb62347bee05292a556ee6d8228b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          chrmstp.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                                          • Size 6.6MB
                                                          • SHA256 4ed5bf7291a8080a017850db43aaa77419056e7282a827e8a6ad2e3a3df7ac58
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          setup.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
                                                          • Size 6.6MB
                                                          • SHA256 f7d2f342b3816b1eef36a4b3d4018d079771bdf7ab19ea99afdee2af836c55ea
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          chrome_pwa_launcher.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                                          • Size 2.3MB
                                                          • SHA256 7862aad8a2193298d1ef07288362a406bbdd721ecc01d05733b7fc1db35ca75d
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          elevated_tracing_service.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                                          • Size 4.0MB
                                                          • SHA256 352fdc75d5995f52ec685017a87dd10ebf6cd21d28549600f3d7c291242fb099
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          elevation_service.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                          • Size 2.8MB
                                                          • SHA256 1a9e07d56a3d1197ebc76a421a59550069cc7c167e322d037538a040c8425069
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          notification_helper.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
                                                          • Size 2.2MB
                                                          • SHA256 bd760b48a93f1ca0382676b6b56ba8ae9471376c62b75edb6f8b1e0113696e4b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          os_update_handler.exe
                                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
                                                          • Size 2.4MB
                                                          • SHA256 8f45df4586a2d906886e3dd435ecef447e6f30ba9d2f196d350101cecb05a323
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          firefox.exe
                                                          • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                          • Size 1.2MB
                                                          • SHA256 ab5eb9df4e33c10a0850c37cbaa87d92a7f182d2c57841211ec51a8343edeb14
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          MsSense.exe
                                                          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                          • Size 1.6MB
                                                          • SHA256 b2d1c66a061302ca12eeaa494e16f92f0ce08278561cdec6022afe11372afcf5
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          NisSrv.exe
                                                          • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                          • Size 3.5MB
                                                          • SHA256 302440f81453d4875a77fbaba8f47743734df3902fbd311ac65aab915e5523f0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          wmpnetwk.exe
                                                          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                          • Size 1.4MB
                                                          • SHA256 574b9840e5001bda27956c11697c499f480be0ddfa124a20f3bdd51fa2973d11
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          dotnet.exe
                                                          • Path C:\Program Files\dotnet\dotnet.exe
                                                          • Size 1.3MB
                                                          • SHA256 4c9bcd0ad5c91fd55ac5770cb7768ebaf99696d02dde26ec2d45320d8f778aee
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Windows.db
                                                          • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                          • Size 1.1MB
                                                          • SHA256 6ac8cca60554efcfd51c6851d156db0d2a51547ad38d69637f66d0202c18d5e0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Windows.db-wal
                                                          • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                          • Size 321KB
                                                          • SHA256 071d29ca45561fa25446f67bb10cca9f427e1117e66c4546dd7fd4b682306500
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          settings.dat
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                          • Size 280B
                                                          • SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          BookmarkMergedSurfaceOrdering
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                          • Size 6B
                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          BrowsingTopicsState
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                          • Size 414B
                                                          • SHA256 7a5b41e9d7a322c0bcd0e8e5687d130c03faf03287b47a046feac7bc9490340f
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          the-real-index
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                          • Size 3KB
                                                          • SHA256 1d5d9f0c227f489d40594dcc77666798cf7cf058a7e7b8b74864d06f8cd4601e
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          the-real-index~RFe5aa3f2.TMP
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aa3f2.TMP
                                                          • Size 3KB
                                                          • SHA256 ecf4edd01d8e8e75a9ff10818839665f5b3617cd59666aadf7ee9da274287b4c
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          SiteList-Enterprise.json
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                          • Size 2B
                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Network Persistent State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                          • Size 2KB
                                                          • SHA256 d30b5718eef578cb1624b2c10e0d3ec4424ae25db0a5a9ddf1e0ffd69c3a468a
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          SCT Auditing Pending Reports
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                          • Size 2B
                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Sdch Dictionaries
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                          • Size 40B
                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                          • MD5 SHA1 SHA512
                                                          Submit Download

                                                          Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                          • Size 16KB
                                                          • SHA256 3f122353ad3aeb2021b5737c71c725056fcd9e50d7254731a6b21a4b827e31a0
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Secure Preferences
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                          • Size 32KB
                                                          • SHA256 81f2b76c2340eaae41654d37a1943f1c07320d6d3aac5d535c68e7a444d00a89
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          sync_diagnostic.log
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                          • Size 23KB
                                                          • SHA256 496a4fcc4bf67bc4393f6f490082e19b21b4b24bfbb28987d472e6cd6d5b13d4
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 28KB
                                                          • SHA256 158833069083b02f22850646783ca630bcef1f9e8731a7c633da7058a24ee163
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 28KB
                                                          • SHA256 bb4502c341ad66fafac35f631f614aedeecebb27ef1687b118a15fdb0e0a432e
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 26KB
                                                          • SHA256 217d1ae2e39f9b7ca4bce89a938b82e6cfa92f89b5cebaf624ba44b22ba752c4
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 28KB
                                                          • SHA256 5e2f3a187d68b6f808dd7d80f7756a952c2018607ba0a7d2f16f44c7811866d3
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 28KB
                                                          • SHA256 ef89c44fb433cd3a7ff1d496b4bb596071fe2bedc2ef3a2f4eee68c1c439b87f
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          Local State
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                          • Size 33KB
                                                          • SHA256 4d8bfe953a61bc5f200cb6c9f07c5bd5f79995520a8029ad51414e2b8c0be652
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                          • Size 153KB
                                                          • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          metadata.json
                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                          • Size 132B
                                                          • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
                                                          • Size 16KB
                                                          • SHA256 b5b3a3b3be3542348693481518a4c52f79c44c353e2921a3e616199eed8a5d09
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                          • Size 16KB
                                                          • SHA256 26610ccb0fcef2501706fd7a3a0fbc9a0faad9c107676187de6e663bdd0ff511
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          webext.sc.lz4
                                                          • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n6eagavx.default-release\startupCache\webext.sc.lz4
                                                          • Size 105KB
                                                          • SHA256 8c7d57d82aa8a252c6ca239fa534b656260f10e9219069ad336cd9df324664d7
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          b106e480-09ef-4c71-a622-11d34d3fdb95.zip
                                                          • Path C:\Users\Admin\AppData\Local\Temp\b106e480-09ef-4c71-a622-11d34d3fdb95.zip
                                                          • Size 3.7MB
                                                          • SHA256 e9c028f3f7c77b2fcc2c8a280e20a862eb5cf106c8a7ffcfb5c278dc8f9b5875
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          tmpaddon
                                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                          • Size 11KB
                                                          • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          tmpaddon
                                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                          • Size 21.6MB
                                                          • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          tmpaddon
                                                          • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                          • Size 502KB
                                                          • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          compatibility.ini
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\compatibility.ini
                                                          • Size 198B
                                                          • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          data.safe.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
                                                          • Size 7KB
                                                          • SHA256 88a3871f8363c00195c9f7724b1cad2a97c276560180881d55584fc7d75c8af5
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          data.safe.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
                                                          • Size 6KB
                                                          • SHA256 16065e5444d2d9c2f875b0067af673fd5b9b10f095b4cd7d40a74b5a5562d5ba
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          data.safe.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
                                                          • Size 30KB
                                                          • SHA256 4505efb3dae11d5caf18cc1dc125a96174d43dee8caa5cb77ba8240208abb3ef
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          data.safe.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
                                                          • Size 30KB
                                                          • SHA256 7361250e300e50b8c175f664c81dfccde745ff3980be8537f3fe2436af016f4a
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          data.safe.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
                                                          • Size 30KB
                                                          • SHA256 46ae8dd026bd718ca64dfee2607f620e84396524eb324d862a7add054a120616
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          data.safe.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\db\data.safe.tmp
                                                          • Size 6KB
                                                          • SHA256 ded1ae1f811615aead60a01d762849eb299eb5d36e4c4d73bbe8c8f1800ae7e9
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          events
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\events\events
                                                          • Size 1KB
                                                          • SHA256 212de386879d4955f18c25bea036b71e1bfa843bcd65e3b8aaceef0c79a58dcc
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          222ff19e-d2a9-4430-b85a-1f086594c883
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\222ff19e-d2a9-4430-b85a-1f086594c883
                                                          • Size 235B
                                                          • SHA256 e475b3af6e259d20e71ad37519ec1b770313791cd1b60dfc60c1cd5693f0ce1f
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          2d11303e-aa30-42e2-ae88-448c2101bb09
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\2d11303e-aa30-42e2-ae88-448c2101bb09
                                                          • Size 235B
                                                          • SHA256 3cc0a1c52418eb94d9b86caa7792aedfd3f2720711f9c368e9f09fb598feefc9
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          9b66bce7-955f-4c9d-9c3d-24de850e71e6
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\9b66bce7-955f-4c9d-9c3d-24de850e71e6
                                                          • Size 15KB
                                                          • SHA256 f4337ed5aa3967a98b7b62b9bfe7b16bd2fe18c1059edeace51056c776e15ee3
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          c1b0b7b7-424c-4048-a991-f84c884d8dc3
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\c1b0b7b7-424c-4048-a991-f84c884d8dc3
                                                          • Size 2KB
                                                          • SHA256 b18e30ae005d25806f343fbcad1d9734c5afb3d63bea8ab4bf166cab7efc6054
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          cb3eeabc-e5ba-487d-8013-d5e8ca698f1e
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\cb3eeabc-e5ba-487d-8013-d5e8ca698f1e
                                                          • Size 883B
                                                          • SHA256 ab1fe2a79997f014ccac131d4db6eaa58ca881513c24b08d88d7090f0ea8d7dd
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          fef84f1f-5964-410d-b9ab-05a426310df3
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\datareporting\glean\pending_pings\fef84f1f-5964-410d-b9ab-05a426310df3
                                                          • Size 886B
                                                          • SHA256 83516bfdf6596f412ebd3853a11ee7ec35038318d2e97d27283740a359b0d763
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          extensions.json
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\extensions.json
                                                          • Size 16KB
                                                          • SHA256 aac61cd6d6c60c4383bd361734a597e7658957904cbc9dcfb5ea075d800d7ae7
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          gmpopenh264.dll
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                          • Size 1.1MB
                                                          • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          gmpopenh264.info
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                          • Size 116B
                                                          • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          LICENSE.tmp
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE.tmp
                                                          • Size 473B
                                                          • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          manifest.json
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                          • Size 1002B
                                                          • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          widevinecdm.dll
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                          • Size 21.6MB
                                                          • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          prefs-1.js
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
                                                          • Size 6KB
                                                          • SHA256 5302ad1bc882514f4583ef821f8a16ebcc6b7af71b335802048ed22be509ad47
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          prefs-1.js
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
                                                          • Size 8KB
                                                          • SHA256 6cae348c2f10334438dd0fa6f6f97a7d3fb5a3d3a4f37a837ee0bcf7340b5644
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          prefs-1.js
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs-1.js
                                                          • Size 6KB
                                                          • SHA256 abbfb1cf547948e9100d7f20543a0dc22b999283a24101bdf242a3ab5d0c99b2
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          prefs.js
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs.js
                                                          • Size 7KB
                                                          • SHA256 c9700ed13dd88a7261c03123b99646b59512c3d6c4337610244a50af25174698
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          prefs.js
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\prefs.js
                                                          • Size 6KB
                                                          • SHA256 f6a83910dca8dd0fd03020ee8cabe141e7298577f59f6aa4ca21e48b6c286937
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          recovery.jsonlz4
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\sessionstore-backups\recovery.jsonlz4
                                                          • Size 4KB
                                                          • SHA256 f751ed4d8b7ee9d6b43c820b28a2f38a599d9265f42812606ba14fa6d7e8f768
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          3870112724rsegmnoittet-es.sqlite
                                                          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6eagavx.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                          • Size 13.2MB
                                                          • SHA256 b249ffa1d8ca717ed70bcbf16e7ed9b49d153fac68fdff81a357a25fc62d6264
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          perfhost.exe
                                                          • Path C:\Windows\SysWOW64\perfhost.exe
                                                          • Size 1.2MB
                                                          • SHA256 8d0d4588f26fe20357a45de2dd4b8e2580aac17c8d064dd113d01b7488fe80f5
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          AgentService.exe
                                                          • Path C:\Windows\System32\AgentService.exe
                                                          • Size 1.4MB
                                                          • SHA256 bae62ff1f12f3aeb9a6c778f2cf16f1106b06da2f0db9911b6b3a2e28b44a01e
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          ssh-agent.exe
                                                          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                          • Size 1.7MB
                                                          • SHA256 96ade1135c85466b1705491fce899885437c4badfa89c7d9f93211bf7b4d99cf
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          PerceptionSimulationService.exe
                                                          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                          • Size 1.4MB
                                                          • SHA256 e890c28166108022f8ed1b600e65200db659cd365eb17f3616236381f1323701
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          ReFsDedupSvc.exe
                                                          • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                          • Size 2.6MB
                                                          • SHA256 1d2161d9c08c809a16ba4cf8cab9252bb2747a918523f2a9245984c03d35b605
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          SearchIndexer.exe
                                                          • Path C:\Windows\System32\SearchIndexer.exe
                                                          • Size 1.4MB
                                                          • SHA256 fe2451aca23500271bfdb1c80b557698049b398deb334b9df4f2f1382f423d53
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          SensorDataService.exe
                                                          • Path C:\Windows\System32\SensorDataService.exe
                                                          • Size 1.7MB
                                                          • SHA256 7e3e2fae58a41ae6136abcd1bc0ccfd6f85dcd947e8d7e2745879b82f0a964ea
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          AppVClient.exe
                                                          • Path C:\Windows\system32\AppVClient.exe
                                                          • Size 1.3MB
                                                          • SHA256 e8a213df70ee4d24015248b2004c1b2cd82df5b3bb364fbc7375ed681607ccb3
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          SgrmBroker.exe
                                                          • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                          • Size 1.6MB
                                                          • SHA256 1b127e9dfdd43f81b131c7126637670f5eb52f37b44e8a698fe3624d7af98942
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          memory/2540-37-0x0000000140000000-0x0000000140214000-memory.dmp
                                                          Download

                                                          memory/2540-50-0x0000000140000000-0x0000000140214000-memory.dmp
                                                          Download

                                                          memory/2540-48-0x0000000001700000-0x0000000001760000-memory.dmp
                                                          Download

                                                          memory/2540-44-0x0000000001700000-0x0000000001760000-memory.dmp
                                                          Download

                                                          memory/2540-38-0x0000000001700000-0x0000000001760000-memory.dmp
                                                          Download

                                                          memory/4468-105-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                          Download

                                                          memory/4468-111-0x0000000140000000-0x000000014027D000-memory.dmp
                                                          Download

                                                          memory/4468-112-0x0000000000CF0000-0x0000000000D50000-memory.dmp
                                                          Download

                                                          memory/4468-307-0x0000000140000000-0x000000014027D000-memory.dmp
                                                          Download

                                                          memory/4704-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                          Download

                                                          memory/4704-64-0x0000000000C70000-0x0000000000CD0000-memory.dmp
                                                          Download

                                                          memory/4704-72-0x0000000140000000-0x000000014020A000-memory.dmp
                                                          Download

                                                          memory/4704-269-0x0000000140000000-0x000000014020A000-memory.dmp
                                                          Download

                                                          memory/4804-134-0x0000000000620000-0x0000000000680000-memory.dmp
                                                          Download

                                                          memory/4804-311-0x0000000140000000-0x0000000140172000-memory.dmp
                                                          Download

                                                          memory/4804-136-0x0000000140000000-0x0000000140172000-memory.dmp
                                                          Download

                                                          memory/4804-141-0x0000000000620000-0x0000000000680000-memory.dmp
                                                          Download

                                                          memory/4816-76-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                          Download

                                                          memory/4816-278-0x0000000000400000-0x00000000005D6000-memory.dmp
                                                          Download

                                                          memory/5240-25-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                          Download

                                                          memory/5240-34-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                          Download

                                                          memory/5240-26-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                          Download

                                                          memory/5240-133-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                          Download

                                                          memory/5240-772-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                          Download

                                                          memory/5240-774-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                          Download

                                                          memory/5284-239-0x0000000140000000-0x000000014020E000-memory.dmp
                                                          Download

                                                          memory/5284-53-0x00000000008C0000-0x0000000000920000-memory.dmp
                                                          Download

                                                          memory/5284-52-0x0000000140000000-0x000000014020E000-memory.dmp
                                                          Download

                                                          memory/5284-59-0x00000000008C0000-0x0000000000920000-memory.dmp
                                                          Download

                                                          memory/5400-308-0x0000000000740000-0x00000000007A0000-memory.dmp
                                                          Download

                                                          memory/5400-310-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                          Download

                                                          memory/5400-98-0x0000000000740000-0x00000000007A0000-memory.dmp
                                                          Download

                                                          memory/5400-91-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                          Download

                                                          memory/5400-306-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                          Download

                                                          memory/5400-92-0x0000000000740000-0x00000000007A0000-memory.dmp
                                                          Download

                                                          memory/5448-130-0x0000000140000000-0x0000000140168000-memory.dmp
                                                          Download

                                                          memory/5448-124-0x0000000140000000-0x0000000140168000-memory.dmp
                                                          Download

                                                          memory/5448-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                          Download

                                                          memory/5448-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                          Download

                                                          memory/5448-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                          Download

                                                          memory/6216-86-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                          Download

                                                          memory/6216-291-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                          Download

                                                          memory/6216-809-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                          Download

                                                          memory/6216-85-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                          Download

                                                          memory/6216-79-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                          Download

                                                          memory/6216-807-0x0000000000750000-0x00000000007B0000-memory.dmp
                                                          Download

                                                          memory/6268-103-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                          Download

                                                          memory/6268-21-0x0000000000E70000-0x0000000000ED0000-memory.dmp
                                                          Download

                                                          memory/6268-13-0x0000000000E70000-0x0000000000ED0000-memory.dmp
                                                          Download

                                                          memory/6268-12-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                          Download

                                                          memory/7000-1013-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                          Download

                                                          memory/7000-75-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                          Download

                                                          memory/7000-5-0x0000000002CC0000-0x0000000002D27000-memory.dmp
                                                          Download

                                                          memory/7000-7-0x0000000000400000-0x0000000000A61000-memory.dmp
                                                          Download

                                                          memory/7000-0-0x0000000002CC0000-0x0000000002D27000-memory.dmp
                                                          Download