Overview

overview

10

Static

static

10

2026-08-19...op.exe

windows10-2004-x64

9

2026-08-19...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 17:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_d45dffe7b7acf15a33baf25b699cc70a_darkgate_elex_glassworm_remcos_stealc_stop.exe
  • Size 6.5MB
  • Sample260819-vyzkasem21
  • SHA256 504cd2f8f5eb59671b9d09fa991ae0b083c4ae99c8c050ff001c867f8cfa5341
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • A potential corporate email address has been identified in the URL: [email protected]
    phishing
  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  • Drops file in System32 directory 58 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_d45dffe7b7acf15a33baf25b699cc70a_darkgate_elex_glassworm_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_d45dffe7b7acf15a33baf25b699cc70a_darkgate_elex_glassworm_remcos_stealc_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3428
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:5784
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5280
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:548
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27097 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {e1b48f2f-b8d6-443f-b7b5-e80fca1434d1} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:1548
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2392 -prefsLen 27133 -prefMapHandle 2488 -prefMapSize 270279 -ipcHandle 2496 -initialChannelId {a54b958c-a18c-4456-a860-15b4971166f7} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            PID:2600
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 25164 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {af080915-8ac7-4339-8c2c-335ec5996658} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5624
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 4036 -initialChannelId {f45e37d0-506f-4c4f-9048-e32503d72ab8} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:3892
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460 -prefsLen 34773 -prefMapHandle 4464 -prefMapSize 270279 -jsInitHandle 4468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4484 -initialChannelId {3fe2ac4e-286d-440e-96a5-e48f018ac24d} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5648
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2816 -prefsLen 35010 -prefMapHandle 5148 -prefMapSize 270279 -ipcHandle 5156 -initialChannelId {0a23978d-5d10-4869-bcc1-91a69e2500b6} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6404
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5000 -prefsLen 35062 -prefMapHandle 5504 -prefMapSize 270279 -jsInitHandle 5512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {d0d84069-56ca-457b-9bf6-5314d39389f4} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6524
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4392 -prefsLen 32952 -prefMapHandle 1688 -prefMapSize 270279 -jsInitHandle 5788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5796 -initialChannelId {c68e1a24-84b7-4706-8c8a-33debec70ec2} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6848
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5964 -prefsLen 32952 -prefMapHandle 5968 -prefMapSize 270279 -jsInitHandle 5972 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5504 -initialChannelId {2bbbd31b-3440-4ece-8ef0-2bf684b47581} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6856
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5080 -prefsLen 32952 -prefMapHandle 5084 -prefMapSize 270279 -jsInitHandle 5088 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6120 -initialChannelId {1e330673-e2a6-430e-a311-e6cc88ea67a8} -parentPid 548 -crashReporter "\\.\pipe\gecko-crash-server-pipe.548" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6872
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:360
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4932
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2656
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5668
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b08
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6156
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2d0,0x334,0x7ff90a7bc188,0x7ff90a7bc194,0x7ff90a7bc1a0
          3⤵
            PID:6192
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,5731136596950616746,16793205331346599792,262144 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
            3⤵
              PID:6792
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,18340859276179158329,1791012276585010337,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:11
              3⤵
              • System Time Discovery
              PID:6804
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,8940914782396676271,16180419407817042498,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
              3⤵
                PID:6896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,12825595268273378841,16063983040945366235,2097152 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
                3⤵
                  PID:7008
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16328217207359792447,5496387857846919103,2097152 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
                  3⤵
                    PID:6992
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,3143263747444549642,9038933446639479968,2097152 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
                    3⤵
                      PID:5108
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,4789323710482384775,1258817392167167857,2097152 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
                      3⤵
                        PID:4912
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,6272546771246573250,16754840330413555106,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
                        3⤵
                          PID:5148
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,13605816097376751375,10829978009384421465,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
                          3⤵
                            PID:2648
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13586164591515218202,3065376990098843898,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
                            3⤵
                              PID:2168
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,1719366416510367965,2286788172996431038,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
                              3⤵
                                PID:2540
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,1719366416510367965,2286788172996431038,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
                                3⤵
                                  PID:2844
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3199465215545239537,5409230290704632300,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
                                  3⤵
                                    PID:1144
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,1448881991276468144,14249335279543484346,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
                                    3⤵
                                      PID:4176
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,1297710211713394102,2761428478174635959,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
                                      3⤵
                                        PID:5100
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,5437211002122685701,2094890249323894696,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
                                        3⤵
                                          PID:4844
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,18163771117261679441,9872987942371011945,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
                                          3⤵
                                            PID:4204
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,13789697568901124029,9574973964902608651,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
                                            3⤵
                                              PID:2676
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,3423425397576825378,15228442282088359222,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
                                              3⤵
                                                PID:5672
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,10655513626897104578,18180053999589852171,524288 --field-trial-handle=2280,i,13326144454197682998,5344862176588707456,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
                                                3⤵
                                                  PID:4160
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 2344
                                                2⤵
                                                • Program crash
                                                PID:6916
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              PID:3316
                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              PID:2728
                                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1696
                                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5296
                                            • C:\Windows\SysWow64\perfhost.exe
                                              C:\Windows\SysWow64\perfhost.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:8
                                            • C:\Windows\System32\ReFsDedupSvc.exe
                                              C:\Windows\System32\ReFsDedupSvc.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4136
                                            • C:\Windows\System32\SensorDataService.exe
                                              C:\Windows\System32\SensorDataService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Checks SCSI registry key(s)
                                              PID:3256
                                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:2400
                                            • C:\Windows\system32\AgentService.exe
                                              C:\Windows\system32\AgentService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5412
                                            • C:\Windows\system32\SearchIndexer.exe
                                              C:\Windows\system32\SearchIndexer.exe /Embedding
                                              1⤵
                                              • Executes dropped EXE
                                              • Enumerates connected drives
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4588
                                              • C:\Windows\System32\SearchProtocolHost.exe
                                                "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                2⤵
                                                  PID:2604
                                                • C:\Windows\System32\SearchProtocolHost.exe
                                                  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:3348
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                  2⤵
                                                    PID:3780
                                                  • C:\Windows\System32\SearchFilterHost.exe
                                                    "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                    2⤵
                                                    • Modifies data under HKEY_USERS
                                                    PID:4112
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                  1⤵
                                                    PID:5868
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                    1⤵
                                                      PID:6436
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                      1⤵
                                                        PID:4176
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3428 -ip 3428
                                                          2⤵
                                                            PID:5520
                                                        • C:\Windows\system32\verclsid.exe
                                                          "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                          1⤵
                                                          • System Binary Proxy Execution: Verclsid
                                                          PID:3320

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Browser Extensions

                                                              1
                                                              T1176

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Defense Evasion

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              System Binary Proxy Execution

                                                              1
                                                              T1218

                                                              Verclsid

                                                              1
                                                              T1218.012

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Peripheral Device Discovery

                                                              2
                                                              T1120

                                                              Query Registry

                                                              5
                                                              T1012

                                                              System Information Discovery

                                                              6
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              elevation_service.exe
                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              • Size 2.7MB
                                                              • SHA256 e3b3e2c053cab662c47d16240ce91ba4204beb4e8ab95cda7f515d5863929c79
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              maintenanceservice.exe
                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                              • Size 1.7MB
                                                              • SHA256 da23df5cddb4881de05fc005fd030ed5fb44302e960c68893db4eb9dacefddd9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7z.exe
                                                              • Path C:\Program Files\7-Zip\7z.exe
                                                              • Size 2.0MB
                                                              • SHA256 659a9aa524963c27edfbd41732d9b7048f5e14ee8dab60c24b561fde68bc24d8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7zFM.exe
                                                              • Path C:\Program Files\7-Zip\7zFM.exe
                                                              • Size 1.5MB
                                                              • SHA256 78cc6afefcfd9f6af80370a1e899f3b826c6c6e63e7477c5f58e6c4be92e9b1d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7zG.exe
                                                              • Path C:\Program Files\7-Zip\7zG.exe
                                                              • Size 1.2MB
                                                              • SHA256 5e836a51c26f726fc77026737e8d30cb09f536394cd47c3c7a40a52d1da0cab5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Uninstall.exe
                                                              • Path C:\Program Files\7-Zip\Uninstall.exe
                                                              • Size 1.4MB
                                                              • SHA256 0e91d1a30e4983ec2ba396d7aa37537871fbea1892899a1e2fea0e2bd1a6783a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppVShNotify.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                              • Size 1.7MB
                                                              • SHA256 6c347a27a050ff2a25dcc3546dc23f6ff00eb4699d7db8e94e107628a6625299
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              IntegratedOffice.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                              • Size 4.6MB
                                                              • SHA256 b2e1414dea3227a08dae4c72c35177ba30195aa44e38422edfb2ddae74b648f2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              MavInject32.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                              • Size 1.8MB
                                                              • SHA256 b44584902df5ad34cf4aafe8a7802e38c4c04bbf2155a859bb5633e49aad740c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OfficeC2RClient.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                              • Size 24.0MB
                                                              • SHA256 82be13a67eee90e5518273b4dbb700e7609858344a1b0740c953199d7d2dfa64
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              appvcleaner.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                              • Size 2.7MB
                                                              • SHA256 41aff6e096268e530d154367de5753f6e809b9e7f5eb197ca63d424ee48943fd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              LICLUA.EXE
                                                              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                              • Size 1.1MB
                                                              • SHA256 831382d61db0b3e157ea343f8a6f268e7d1ab497bafb00283ba2c8d095e945ba
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OSE.EXE
                                                              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                              • Size 1.7MB
                                                              • SHA256 b14110f70953bd3e144070cb6cf11848eccb1c4ea3bfa1c7574ca2f4b394ee3f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              VSTOInstaller.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                              • Size 1.5MB
                                                              • SHA256 25c34eaf63ba4038e38f2dab9e7f355ddd4b7b0cddf07066235d7f64d450de48
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              chrmstp.exe
                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
                                                              • Size 6.6MB
                                                              • SHA256 40ad7980b4a62ba11a076faef7d91381646519aa83a3ddfe8d937d05ab98b67d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              chrome_pwa_launcher.exe
                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                                              • Size 2.3MB
                                                              • SHA256 8f535e10cd22c43e7936b56d4d809889581b3e549a1e9ed0a514932a3745d71f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              elevated_tracing_service.exe
                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                                              • Size 4.0MB
                                                              • SHA256 e7ee5d37ff0cd3b7501070aef97011f6ee42319bb3601c3c262c1e0e150caf51
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              firefox.exe
                                                              • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                              • Size 1.2MB
                                                              • SHA256 95eccedf640fb35befa4b5ee65491f5f97c15b09c8f4e6409685df01dbae50bb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              MsSense.exe
                                                              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                              • Size 1.9MB
                                                              • SHA256 62047ed96ab95510172cb651a76d7b693ec52852f27e40a04b48f24145d9ffb7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              NisSrv.exe
                                                              • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                              • Size 3.5MB
                                                              • SHA256 9807fdb74b4e8cbb3d0154412e12410c38fb7261dad09d0e3dfc73ecb7382c14
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              wmpnetwk.exe
                                                              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                              • Size 1.4MB
                                                              • SHA256 f6e18e8b2b90c58f8fb27fa5db639902813aae42d6818e0b142a674b7f76bfb3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              dotnet.exe
                                                              • Path C:\Program Files\dotnet\dotnet.exe
                                                              • Size 1.6MB
                                                              • SHA256 72eb688ac5d6e63f4c30d76f33710d1cd57da501e92b5f8ccd917902e889df94
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Windows.db
                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                              • Size 968KB
                                                              • SHA256 a1986e92d86b7ee6e13cb7819cebb41de5d4e071546238f0f82e49256c2b27b5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Windows.db-wal
                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                              • Size 321KB
                                                              • SHA256 171c3842c08804f60da36a56d701cf376215b7a0c8ab1fce76b7198bad069a2a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              blocklist
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                              • Size 105KB
                                                              • SHA256 44ad41f86fc5dfdef9271828918ef29a810e56b8958f687546cd2d840b9240aa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 1KB
                                                              • SHA256 2a141ead8866d9e56a147bc76abf00f17f917ee023f2d52637b87f3899222487
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 2KB
                                                              • SHA256 042e55cffedeb42816bf8f2aae9f24c39f03b37e3980c78471e65faebe7d0e7b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 b09defe89f00d722b66373a72b4157c2f2cb3bb917e400b01c39beda8f0e83bf
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 f064f57c880802e63ca5bc4a179815d9c9e9671f0e7e064ceeab228fce0d6ac0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 32KB
                                                              • SHA256 e8adfd48d90c3851186bc5c2a2292242947477dfa30503f0b04731cc31583249
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 4KB
                                                              • SHA256 848ad2591cbaf24ea9ca1e899d8d3554dddc7d6d416134b412d49d01cdae7c3e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OperationConfig
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OperationConfig~RFe5b150b.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b150b.TMP
                                                              • Size 3KB
                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 42KB
                                                              • SHA256 216a8ef7dddf9341c5368a59266a033d98959df25a58c8124eb0e1ba92f1dd91
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 34KB
                                                              • SHA256 416d9b3912fa4c4467960dc115bb6588ab1f94fb19afb7043935dcf300195d00
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 5450922540585027be74a2cd4d8617a12a3bebf27ad8d05d7f82676c02a1d24d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 33KB
                                                              • SHA256 d4c3e5bd196e71ed5e4e0be64ae0f4d75ad9458f6af8dc8efe15ef8aa38124d6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 39KB
                                                              • SHA256 19cef5ed2e1df40bb91273dd8757eee6a6987ff857c15d82b5ce74187b8e7161
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              cf0a4633-0479-4dba-8059-a480ce25c1fa.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cf0a4633-0479-4dba-8059-a480ce25c1fa.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                              • Size 16KB
                                                              • SHA256 fcb72ae12662ccac96f994d2a1ca679ccdf0f1cece2a57b28604396ca5248fdd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              webext.sc.lz4
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wg40zd9z.default-release\startupCache\webext.sc.lz4
                                                              • Size 105KB
                                                              • SHA256 312d7e0543429c64687635b61ea7d56cce71d6c5b2215e8b2c6ff87ee6b786d8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6156_1708913638\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 11KB
                                                              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 502KB
                                                              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              compatibility.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\compatibility.ini
                                                              • Size 198B
                                                              • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 30KB
                                                              • SHA256 6cdf5310e0bcc933bbb077778a978f6d3b4c0f5db1a9dcbcb32fd2d455279721
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 30KB
                                                              • SHA256 1ea5803fb0467b908c3cff6d7de2865e8c7e6ae38bdc17f81a4564fdfa879305
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 7KB
                                                              • SHA256 cd8256655901f7a32bb8ecf182250f35d463f008798d57e2acb4e8ce3577ee82
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              events
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\events\events
                                                              • Size 1KB
                                                              • SHA256 bd5f921b05855020bbb52a52b5e44666819e37dec3295f69cf1ac4d3ad94c314
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              00c85b51-e0d0-4229-8b13-02dbea272175
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\00c85b51-e0d0-4229-8b13-02dbea272175
                                                              • Size 235B
                                                              • SHA256 b135450f030398b980abeb1786c3693ee461621c49a2d62ba6bfd2481df3dd25
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              5c2ec0d5-1746-4fdf-ac31-5efccd6346f5
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\5c2ec0d5-1746-4fdf-ac31-5efccd6346f5
                                                              • Size 16KB
                                                              • SHA256 59a42a3cb8fae7697ea98ab0fbd13e5b6e83059e85eb4eb1fa1c5c7ebf2c78d8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              6ecf757f-a13d-4a06-8cab-afcf59d36905
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\6ecf757f-a13d-4a06-8cab-afcf59d36905
                                                              • Size 886B
                                                              • SHA256 9627daa52dbf991f53022dc0e606acaec7d66d443cbcce55aeabb43ec01341c8
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              78697935-5158-4ec8-a85f-5ae20f3c9d9c
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\78697935-5158-4ec8-a85f-5ae20f3c9d9c
                                                              • Size 883B
                                                              • SHA256 3b7594ef176aae417261cd09363310c5677b0c30cc0335035105146603db9681
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              a5ae5b6a-b6d0-474b-871c-0d484d5375ae
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\a5ae5b6a-b6d0-474b-871c-0d484d5375ae
                                                              • Size 235B
                                                              • SHA256 f59e616e480b8a16028d2c121878b5a61328ada5242f2681b1cab0a3ec3f418c
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              cfae3d07-d735-4759-b1e6-bf428feefa7a
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\datareporting\glean\pending_pings\cfae3d07-d735-4759-b1e6-bf428feefa7a
                                                              • Size 2KB
                                                              • SHA256 61cd3c1fa57d08b0e9ab95cdbfd7f8e828e3c745a33e921090b03aa13495044e
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              extensions.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\extensions.json
                                                              • Size 16KB
                                                              • SHA256 9a6bc21b025796ab54a0d86896ffe2ddf082493e9f32020a89bad8439e705a03
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                              • Size 1.1MB
                                                              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.info
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                              • Size 116B
                                                              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                              • Size 1002B
                                                              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              widevinecdm.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                              • Size 21.6MB
                                                              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
                                                              • Size 6KB
                                                              • SHA256 90ac31c363451d8cf8391ff603b9409ec3e6c152a9038a27ab467abb38daf755
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
                                                              • Size 8KB
                                                              • SHA256 b3749f1748847d4c0e82e55abe6258d11219594796996373533b9c2040661d27
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs-1.js
                                                              • Size 12KB
                                                              • SHA256 8391fb3073f318ded8fabe20d12b50ded6f7d11927a8221e919eb92ee052a06c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 9bcc791802b729f7fa6a412c9676f905e70586918277a2bef9c8d7856e727607
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 5610ed6caba23ec89597d857cae388b863e619b1145aa3b59aa059170c9ea741
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.baklz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\sessionstore-backups\recovery.baklz4
                                                              • Size 4KB
                                                              • SHA256 367fb0a0f89435646385e751bde165a17772068476de11de75341c4dd0a53e68
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.jsonlz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\sessionstore-backups\recovery.jsonlz4
                                                              • Size 4KB
                                                              • SHA256 7efa69e5952abac60aac8898b3694382541a43b61df8370e73568aca37338470
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3870112724rsegmnoittet-es.sqlite
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wg40zd9z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                              • Size 5.4MB
                                                              • SHA256 f8545018a8d519b6856ab439a08f143408d995aef817f5d1781b0ae76f4d7e52
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              perfhost.exe
                                                              • Path C:\Windows\SysWOW64\perfhost.exe
                                                              • Size 1.4MB
                                                              • SHA256 6a8f88174a37e5f53792d6fe9a88ae9b7302aaa9357e68fe39fa8ef62bcfd061
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AgentService.exe
                                                              • Path C:\Windows\System32\AgentService.exe
                                                              • Size 1.4MB
                                                              • SHA256 be874941d61dabbc92a6ce541564a6e63b2a21c87804015aa7bb9d11880099bd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ssh-agent.exe
                                                              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                              • Size 2.0MB
                                                              • SHA256 f4750c0acfeecb409d29a98b6963b5c90d1b8e7fce4e28106b112cd0a4fea96e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              PerceptionSimulationService.exe
                                                              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                                              • Size 1.7MB
                                                              • SHA256 74599eaf737874adcec63ba5a9df378fe88f74d4ca2f5da6c5587275923d97ee
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ReFsDedupSvc.exe
                                                              • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                              • Size 2.6MB
                                                              • SHA256 2097d18eeddaa9b11eddd46774c5df22ce34f2200a2a1e9a6b2ea1d769839b85
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SearchIndexer.exe
                                                              • Path C:\Windows\System32\SearchIndexer.exe
                                                              • Size 1.4MB
                                                              • SHA256 280a79fd75cde444b75816fbdef61f8de90fa7a2365bf53484c3068fd5cdffde
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SensorDataService.exe
                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                              • Size 1.7MB
                                                              • SHA256 0c734bb75a7e57db7d7ac365ad2fa7b687a82e6f26bb245b561d44d09f8156d7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppVClient.exe
                                                              • Path C:\Windows\system32\AppVClient.exe
                                                              • Size 1.3MB
                                                              • SHA256 4f42f1e9dc24ed5482dd6b469d791eec57f1cb5cfbe376eeb046b8a4987a7a33
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SgrmBroker.exe
                                                              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                              • Size 1.8MB
                                                              • SHA256 9e848b010c663c686a308354d45f1274102ec4d328aa108efb6736292e7907aa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              1259044bc618523d.bin
                                                              • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\1259044bc618523d.bin
                                                              • Size 12KB
                                                              • SHA256 c1c855cdbddfc0c828d3047e61264fc68eacfe2de8bd98717599a19986fb5147
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/8-281-0x0000000000400000-0x0000000000656000-memory.dmp
                                                              Download

                                                              memory/8-65-0x0000000000400000-0x0000000000656000-memory.dmp
                                                              Download

                                                              memory/8-71-0x0000000000A80000-0x0000000000AE7000-memory.dmp
                                                              Download

                                                              memory/8-66-0x0000000000A80000-0x0000000000AE7000-memory.dmp
                                                              Download

                                                              memory/1696-169-0x0000000140000000-0x000000014028E000-memory.dmp
                                                              Download

                                                              memory/1696-49-0x00000000009B0000-0x0000000000A10000-memory.dmp
                                                              Download

                                                              memory/1696-41-0x00000000009B0000-0x0000000000A10000-memory.dmp
                                                              Download

                                                              memory/1696-40-0x0000000140000000-0x000000014028E000-memory.dmp
                                                              Download

                                                              memory/2400-100-0x0000000140000000-0x00000001402FD000-memory.dmp
                                                              Download

                                                              memory/2400-1622-0x00000000007C0000-0x0000000000992000-memory.dmp
                                                              Download

                                                              memory/2400-746-0x00000000007C0000-0x0000000000992000-memory.dmp
                                                              Download

                                                              memory/2400-306-0x00000000007C0000-0x0000000000992000-memory.dmp
                                                              Download

                                                              memory/2400-108-0x0000000000F10000-0x0000000000F70000-memory.dmp
                                                              Download

                                                              memory/2400-102-0x0000000000F10000-0x0000000000F70000-memory.dmp
                                                              Download

                                                              memory/2400-302-0x0000000140000000-0x00000001402FD000-memory.dmp
                                                              Download

                                                              memory/2728-35-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                              Download

                                                              memory/2728-37-0x0000000140000000-0x0000000140294000-memory.dmp
                                                              Download

                                                              memory/2728-24-0x0000000140000000-0x0000000140294000-memory.dmp
                                                              Download

                                                              memory/2728-25-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                              Download

                                                              memory/2728-33-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                              Download

                                                              memory/3256-95-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                              Download

                                                              memory/3256-88-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                              Download

                                                              memory/3256-301-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                              Download

                                                              memory/3256-89-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                              Download

                                                              memory/3256-305-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                              Download

                                                              memory/3256-303-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                              Download

                                                              memory/3316-797-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                              Download

                                                              memory/3316-790-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                              Download

                                                              memory/3316-13-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                              Download

                                                              memory/3316-19-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                              Download

                                                              memory/3316-12-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                              Download

                                                              memory/3316-87-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                              Download

                                                              memory/3428-52-0x0000000000400000-0x0000000000A81000-memory.dmp
                                                              Download

                                                              memory/3428-0-0x0000000002E50000-0x0000000002EB7000-memory.dmp
                                                              Download

                                                              memory/3428-5-0x0000000002E50000-0x0000000002EB7000-memory.dmp
                                                              Download

                                                              memory/3428-7-0x0000000000400000-0x0000000000A81000-memory.dmp
                                                              Download

                                                              memory/3428-1090-0x0000000000400000-0x0000000000A81000-memory.dmp
                                                              Download

                                                              memory/4136-82-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                              Download

                                                              memory/4136-75-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                              Download

                                                              memory/4136-300-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                              Download

                                                              memory/4136-76-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                              Download

                                                              memory/4136-747-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                              Download

                                                              memory/4136-749-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                              Download

                                                              memory/4588-307-0x0000000140000000-0x0000000140172000-memory.dmp
                                                              Download

                                                              memory/4588-136-0x0000000000620000-0x0000000000680000-memory.dmp
                                                              Download

                                                              memory/4588-130-0x0000000000620000-0x0000000000680000-memory.dmp
                                                              Download

                                                              memory/4588-129-0x0000000140000000-0x0000000140172000-memory.dmp
                                                              Download

                                                              memory/5296-62-0x0000000140000000-0x000000014028A000-memory.dmp
                                                              Download

                                                              memory/5296-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                              Download

                                                              memory/5296-60-0x0000000000CE0000-0x0000000000D40000-memory.dmp
                                                              Download

                                                              memory/5296-266-0x0000000140000000-0x000000014028A000-memory.dmp
                                                              Download

                                                              memory/5412-114-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                                                              Download

                                                              memory/5412-127-0x0000000140000000-0x0000000140168000-memory.dmp
                                                              Download

                                                              memory/5412-125-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                                                              Download

                                                              memory/5412-120-0x0000000000C40000-0x0000000000CA0000-memory.dmp
                                                              Download

                                                              memory/5412-113-0x0000000140000000-0x0000000140168000-memory.dmp
                                                              Download