Overview

overview

10

Static

static

10

2026-08-30...op.exe

windows10-2004-x64

9

2026-08-30...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 04:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-30_ce3654ade8d2d77106f340cad7df3e16_darkgate_elex_glassworm_remcos_stealc_stop.exe
  • Size 6.5MB
  • Sample260831-erenjsvbma
  • SHA256 9387dd96e6db24db1ee39a838513406d0efd89b1cacbbd4d0c01f992ebc7e96f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaregoogledefense_evasiondiscoverypersistencephishingspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • A potential corporate email address has been identified in the URL 1 IoCs
    phishing
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

    Adversaries may abuse Verclsid to proxy execution of malicious code.

    defense_evasion
  • Detected potential entity reuse from brand GOOGLE. 1 IoCs
    phishinggoogle
  • Drops file in System32 directory 58 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-30_ce3654ade8d2d77106f340cad7df3e16_darkgate_elex_glassworm_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-30_ce3654ade8d2d77106f340cad7df3e16_darkgate_elex_glassworm_remcos_stealc_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5364
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:4876
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5780
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • A potential corporate email address has been identified in the URL
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Detected potential entity reuse from brand GOOGLE.
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27098 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {cbd923c4-6fc8-4137-8d06-1fa925c0e27b} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:1568
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2456 -prefsLen 27134 -prefMapHandle 2460 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {6ad17a6f-97cf-4909-aef3-7745e1da14bb} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            PID:248
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3876 -prefsLen 25164 -prefMapHandle 3880 -prefMapSize 270279 -jsInitHandle 3884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3892 -initialChannelId {f331551d-122e-4288-b55c-8cc565a59fcb} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1212
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27274 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4104 -initialChannelId {9db7a2b6-f044-4fa0-8c67-357d59e56b84} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:2740
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4556 -prefsLen 34773 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 4564 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4596 -initialChannelId {f84bf0a6-992d-46fd-b958-708811f32863} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:1032
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5088 -prefsLen 35010 -prefMapHandle 5092 -prefMapSize 270279 -ipcHandle 5044 -initialChannelId {72deaefa-7f92-4c26-b057-c39fefdce4ad} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6272
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 35062 -prefMapHandle 5468 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5480 -initialChannelId {466d0a00-9f04-4ffa-ac45-0bbbae2ccb63} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6444
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5480 -prefsLen 32952 -prefMapHandle 5464 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {e197f6de-c786-4181-bad5-95fab80281f6} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6832
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5688 -initialChannelId {2ebb4109-4f44-4c8c-b927-ec88bfdfa4f8} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6848
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5816 -prefsLen 32952 -prefMapHandle 6036 -prefMapSize 270279 -jsInitHandle 6040 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6048 -initialChannelId {1603cb1c-a1c2-4ca1-b4a9-337efc7b1193} -parentPid 2300 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2300" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6856
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3564
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6224
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6252
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6256
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b10
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6600
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x318,0x7ffe5c87c188,0x7ffe5c87c194,0x7ffe5c87c1a0
          3⤵
            PID:6576
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,8520179374686730996,8550140315584072991,262144 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
            3⤵
              PID:5532
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,10681124596479514893,9663912220255388174,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
              3⤵
              • System Time Discovery
              PID:1636
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,13477459622020520466,12629567567706012341,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:13
              3⤵
                PID:3408
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7325630839369974672,16088418966442574289,2097152 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
                3⤵
                  PID:3456
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13075653631192190526,5005300586030063239,2097152 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
                  3⤵
                    PID:5628
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,4924035796642684360,8541911340682283861,2097152 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:9
                    3⤵
                      PID:5164
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,9694221274692372521,8220333142449972482,2097152 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                      3⤵
                        PID:6120
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5994375837391848930,14653767946155021668,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
                        3⤵
                          PID:6928
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,14522604160503848862,4422502696557680383,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
                          3⤵
                            PID:2816
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,16182622070471157708,3193251142689534128,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
                            3⤵
                              PID:708
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,6730952378510286448,1154006478786826560,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
                              3⤵
                                PID:6456
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,6730952378510286448,1154006478786826560,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
                                3⤵
                                  PID:6492
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,4286147021993999437,8881260460413910327,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                  3⤵
                                    PID:4100
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,1747652674788355515,2188586660990656578,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
                                    3⤵
                                      PID:5052
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,3723033984404523712,17291522347523416424,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
                                      3⤵
                                        PID:3552
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,16748374211788613826,17736688119723443265,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
                                        3⤵
                                          PID:3524
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,15085950305928610189,17217005600744713272,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
                                          3⤵
                                            PID:8120
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,1184788388029611406,16466841357235447908,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
                                            3⤵
                                              PID:8128
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,13380161683289931556,6206600758488817483,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
                                              3⤵
                                                PID:8136
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,5188204764234377693,17214970005049102570,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
                                                3⤵
                                                  PID:1560
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,727937395810518464,15805753499455296466,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
                                                  3⤵
                                                    PID:6280
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=940,i,12865858934470190060,8635628109902674708,524288 --field-trial-handle=2272,i,15769169236350816675,15659693204879753419,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
                                                    3⤵
                                                      PID:8100
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5364 -s 2328
                                                    2⤵
                                                    • Program crash
                                                    PID:5884
                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Drops file in Program Files directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2516
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:3152
                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:2096
                                                • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                  "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Drops file in Program Files directory
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3376
                                                • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                  C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:3548
                                                • C:\Windows\SysWow64\perfhost.exe
                                                  C:\Windows\SysWow64\perfhost.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:1376
                                                • C:\Windows\System32\ReFsDedupSvc.exe
                                                  C:\Windows\System32\ReFsDedupSvc.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Checks processor information in registry
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3900
                                                • C:\Windows\System32\SensorDataService.exe
                                                  C:\Windows\System32\SensorDataService.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Drops file in System32 directory
                                                  • Checks SCSI registry key(s)
                                                  PID:5964
                                                • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                  C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:3416
                                                • C:\Windows\system32\AgentService.exe
                                                  C:\Windows\system32\AgentService.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:4768
                                                • C:\Windows\system32\SearchIndexer.exe
                                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Enumerates connected drives
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5828
                                                  • C:\Windows\System32\SearchProtocolHost.exe
                                                    "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                    2⤵
                                                      PID:3812
                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                      2⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:1408
                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                      "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                      2⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:5412
                                                    • C:\Windows\System32\SearchFilterHost.exe
                                                      "C:\Windows\System32\SearchFilterHost.exe" 944 2852 1884 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                      2⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:5840
                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                      2⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:7988
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                    1⤵
                                                      PID:1212
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5364 -ip 5364
                                                      1⤵
                                                        PID:6828
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                        1⤵
                                                          PID:2676
                                                        • C:\Windows\system32\verclsid.exe
                                                          "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                          1⤵
                                                          • System Binary Proxy Execution: Verclsid
                                                          PID:7584

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Browser Extensions

                                                              1
                                                              T1176

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Defense Evasion

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              System Binary Proxy Execution

                                                              1
                                                              T1218

                                                              Verclsid

                                                              1
                                                              T1218.012

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Peripheral Device Discovery

                                                              2
                                                              T1120

                                                              Query Registry

                                                              5
                                                              T1012

                                                              System Information Discovery

                                                              6
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              elevation_service.exe
                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              • Size 2.7MB
                                                              • SHA256 90742575bde7dcb56aea18c58c7a46326c0a93e2c4af26035f1346b1dbe305f2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              maintenanceservice.exe
                                                              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                              • Size 826KB
                                                              • SHA256 db94b40cbed18821f30ef58d88a840d869d94a10aa7d25c1ac4f1f6a054faa86
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7z.exe
                                                              • Path C:\Program Files\7-Zip\7z.exe
                                                              • Size 1.1MB
                                                              • SHA256 58d5df422fd74d013d34412068bfc990791a237f9a288076fa239084b79bac9a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7zFM.exe
                                                              • Path C:\Program Files\7-Zip\7zFM.exe
                                                              • Size 1.5MB
                                                              • SHA256 8d351fdbe78e5c3fa19dcbf71715915425d6c9854935525a2736dac46c8c6435
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              7zG.exe
                                                              • Path C:\Program Files\7-Zip\7zG.exe
                                                              • Size 1.2MB
                                                              • SHA256 75744e8e57d4ee9748ae046f578702d165f40dcc886a26488feb2788bfc77459
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Uninstall.exe
                                                              • Path C:\Program Files\7-Zip\Uninstall.exe
                                                              • Size 582KB
                                                              • SHA256 bd03298ce6d00efd4648e31fb54e7d66e0d7841a1b8683280a9a5f4317b8c2e2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppVShNotify.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                              • Size 840KB
                                                              • SHA256 8480fb260af91731f7110423f8544dbab2ec3c2f10106444d52b0334da61b966
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              IntegratedOffice.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                              • Size 4.6MB
                                                              • SHA256 b4802750dec353e5bae2acbaff3996f6d3f50b3e58a35020a79562eb2850c08f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              MavInject32.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                              • Size 910KB
                                                              • SHA256 9f0a1c9c03970f0249697d8bde4bbdc7ba633923e9924a86bff3bacc95e1f70f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OfficeC2RClient.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                              • Size 24.0MB
                                                              • SHA256 7650dfbf83bfa0afc28eacaacfba47cddd9b19aece30f97b716199f048741317
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              appvcleaner.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                              • Size 2.7MB
                                                              • SHA256 2440b83fa9bc037473f35eb7a413b77bce6647f64c5296f387a85850890f4703
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              LICLUA.EXE
                                                              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                              • Size 1.1MB
                                                              • SHA256 64bf27028a6daec32c82831788cf690437e384a38faee9c0cb7194d0c7e3ef5f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OSE.EXE
                                                              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                              • Size 805KB
                                                              • SHA256 b0cefdce23a8ef522a28f271f7500d4ff1bc9e43487e71b159a8b64575b964d4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              VSTOInstaller.exe
                                                              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                              • Size 656KB
                                                              • SHA256 7d90f23bf2674fbc9c3950ba24b0b4f9521e9a34d454ada7432811c8e34a1690
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              chrome_pwa_launcher.exe
                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                                              • Size 2.3MB
                                                              • SHA256 11fb545016d0ee7951f9afd1603eb20513db7a976ad8dbb66afd9933fca85ebd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              elevated_tracing_service.exe
                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                                              • Size 4.0MB
                                                              • SHA256 60f91407544db7053dc8b9bacffc523c6451692511238394c143b7e4cf854895
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              elevation_service.exe
                                                              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              • Size 2.8MB
                                                              • SHA256 3bb0d1437bab2382486f289c17e20e48c44140bbe60d16592cf328b3769cb251
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              firefox.exe
                                                              • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                              • Size 1.2MB
                                                              • SHA256 6b0f404b129dc396f75e9fb1ef186585ababfb73ba83fcd03cbda20f537c5b0f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              MsSense.exe
                                                              • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                              • Size 1.0MB
                                                              • SHA256 b4d53f59537b31d8f2e81d19845bd0854f7d1b0ee5afe478169ba62d0b6f736c
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              NisSrv.exe
                                                              • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                              • Size 3.5MB
                                                              • SHA256 6637f16483934880d4e190bc201dc1483a2341cfa54bf261f8831e14d976b2ac
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              wmpnetwk.exe
                                                              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                              • Size 1.4MB
                                                              • SHA256 101bd7bd83915aea26e2ab41b3bdb297922588693a695e18b8bf8ceaf04e3c70
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              dotnet.exe
                                                              • Path C:\Program Files\dotnet\dotnet.exe
                                                              • Size 700KB
                                                              • SHA256 c293ff528ea94c37315f330bedacde3579150e2e3ec0d1b5e40a474c8e67fbc8
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Windows.db
                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                              • Size 1.1MB
                                                              • SHA256 d21c1f71f09bf9c0cebc07dbdc9a0a73bedfc3c2d187736b15df30e657e2017b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Windows.db-wal
                                                              • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                              • Size 394KB
                                                              • SHA256 29723550ba779d76b12b3b8a70139c33c872eed3be729e2867ca24c62d2e3f02
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 1KB
                                                              • SHA256 011d2b0470ee4d942f7eee0ca57573471e6d6386fe243bdff3ef8809ccfee49e
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5a3ccc.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3ccc.TMP
                                                              • Size 1KB
                                                              • SHA256 992ec7c70179cd924cd470a8ebf182a4dd3e76b7429bcfc4875cecc94093b728
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SiteList-Enterprise.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Network Persistent State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                              • Size 2KB
                                                              • SHA256 54d9478e58f2decd448cdbb763d73909cbe8064cd55a7d9471ee4cdb8e362659
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              SCT Auditing Pending Reports
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 47c5ca45aa1f2d260cf07589f9601f788ba2371c8dfeb12cb3456f09682ac015
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 4a618703f2f08a31d2f54893033a2eacf27699d2af3c37c922d9f1d0b6ed39b3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 12KB
                                                              • SHA256 1c6711a8937c59739a2431a1213bfd83c20b048fb0070353ff997e2c9de5e8fd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 29KB
                                                              • SHA256 a8951d83fe0ce7a489d2c9a6eb4878b2e1284d6b76f0f72d4f8a090d241d1a22
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              sync_diagnostic.log
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                              • Size 4KB
                                                              • SHA256 43e17234773fbb6ca7dfdd395cb70d69795373202f52442fa0c1dbc0afd23dd3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OperationConfig
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OperationConfig~RFe5acbdd.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5acbdd.TMP
                                                              • Size 3KB
                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 42KB
                                                              • SHA256 11952ad1652a5911913f2cda0a7701af6b22b291c58f387a064de0328aece96e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 33KB
                                                              • SHA256 9e447abade2a03de89a6a8fce989685d3ea8f749a4953461572ef9ded2a63026
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 1ec6ad7b3757fbde1a7bef2476e979557812600d97318d5ef8057760253083c7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 39KB
                                                              • SHA256 8048d92c669c7678edca6b0dbeb2574c8f0cb25af073f487948670a6c03c6779
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 5de70395ecf3d93e312d160d310f08f452f4d7e8c26295eb1487ba7a2ad268d5
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 33KB
                                                              • SHA256 dfefa96af9280b0864043376268603a7c055fab8359617a4149f32d0a21901d0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 132B
                                                              • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              metadata.json
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                              • Size 252B
                                                              • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              a69b3d2d-7d93-432a-81c4-7d69d55d92ec.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a69b3d2d-7d93-432a-81c4-7d69d55d92ec.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                              • Size 154KB
                                                              • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              metadata.json~RFe5a085e.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a085e.TMP
                                                              • Size 132B
                                                              • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                                                              • Size 16KB
                                                              • SHA256 a9070b411e3aa93cbe0e53bc5730f943cfe3ceef96bdd403630a4bb815a0070e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                                                              • Size 16KB
                                                              • SHA256 e8c476289c70778acd0986717a3a936987a2606f18e05a94fe8c9096f27d7837
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              webext.sc.lz4
                                                              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\fu4ot18b.default-release\startupCache\webext.sc.lz4
                                                              • Size 104KB
                                                              • SHA256 c4ccad6cd066d99bbbd092d7fab61d74b4b37e9318be6f1b3b79a4ca90255735
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              cc4dade7-46fe-42d2-8aaa-b8bc9b03c044.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\cc4dade7-46fe-42d2-8aaa-b8bc9b03c044.tmp
                                                              • Size 1B
                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6600_1925889558\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 11KB
                                                              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              tmpaddon
                                                              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                              • Size 502KB
                                                              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              compatibility.ini
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\compatibility.ini
                                                              • Size 198B
                                                              • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 31KB
                                                              • SHA256 6b43f176c464c7a4d4ea212bc1ebc0ff7d40e23113bb84b1a96368447b0d79c9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 31KB
                                                              • SHA256 ed5130be573e1b94bdb9a5b31b1d20911b771d5deeff1fbc17bfc58c502a843d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 31KB
                                                              • SHA256 8af1a9cc01df7404a7360ace4693b6f8278a329cc14d75254644b9e51ea3d827
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              data.safe.tmp
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\data.safe.tmp
                                                              • Size 7KB
                                                              • SHA256 21af65c5719e37df308083d5fb42265398f2a7b46219e6730f3dd0fad24fc0da
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              events
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\events
                                                              • Size 1KB
                                                              • SHA256 3975eac2edcec7911bd971024aad584c5a14f34a96ca3e66e92fa5b69946f1eb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              45d6b815-ebb5-4294-bb59-e615c4a02ff2
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\45d6b815-ebb5-4294-bb59-e615c4a02ff2
                                                              • Size 235B
                                                              • SHA256 0f07095627c069a2a820148d71328cabf2944816017df7c04d0ce92bef06ed66
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              7a077718-98a3-455c-b6f9-0b57646969ae
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\7a077718-98a3-455c-b6f9-0b57646969ae
                                                              • Size 886B
                                                              • SHA256 891933d9fd957b22318da522ef761d739a862361e889c0c7751bd776cf5ee9f6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              8a1ecdf4-577b-4c20-b3d6-ebe1552bea16
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\8a1ecdf4-577b-4c20-b3d6-ebe1552bea16
                                                              • Size 2KB
                                                              • SHA256 73c096cca1b3d56ac4958c3c38bc9bb33b8a870f53d415f437d05180f5ce9afa
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              adf86e01-a238-4f41-adf1-30238f07d595
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\adf86e01-a238-4f41-adf1-30238f07d595
                                                              • Size 15KB
                                                              • SHA256 e5c9e70ac7e65670198f60018792cdbffb6ae7bcb210d7f80f19a13614931e86
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ee90d59e-d380-4b73-bc4f-8f0a15c899aa
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\ee90d59e-d380-4b73-bc4f-8f0a15c899aa
                                                              • Size 235B
                                                              • SHA256 493aaef5123df8e1d9a9f0ff07b720350ad638df3446a8a7e8e7158b51c14b0b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              fff2b996-775a-4021-ae72-588a8d91113c
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\fff2b996-775a-4021-ae72-588a8d91113c
                                                              • Size 883B
                                                              • SHA256 93d11ea2df64ce295afd739e0c73eed94d25433504c1d6910893071e93b6808b
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              extensions.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extensions.json
                                                              • Size 16KB
                                                              • SHA256 e62009bd8b72140cd6f86c246c0333c9a695e084738d6dc472efdc5d598df6ef
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                              • Size 1.1MB
                                                              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              gmpopenh264.info
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                              • Size 116B
                                                              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              manifest.json
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                              • Size 1002B
                                                              • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              widevinecdm.dll
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                              • Size 21.6MB
                                                              • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
                                                              • Size 6KB
                                                              • SHA256 d66c5700143dd0e099ccece0eda6b5752e52bd1a87c08f52ec4fc77003bd429a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs-1.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs-1.js
                                                              • Size 7KB
                                                              • SHA256 18fc21272428fc4f3bfb937d7d062618c9e4bb6462757804ac31ae590da577f3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 a45e215064d8f305b752acf1d80634a9eb4cfc21b1e0b248a27adb17b8cad3f0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              prefs.js
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\prefs.js
                                                              • Size 6KB
                                                              • SHA256 0e006f166159aebd71336392e5ac13d35d5432ef8ff807a817f1125d17925a45
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.baklz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.baklz4
                                                              • Size 4KB
                                                              • SHA256 6aa5ffa33beabd0499e6f6f042415b60af3c20e2eceab90429fccf08943952ad
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              recovery.jsonlz4
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\recovery.jsonlz4
                                                              • Size 4KB
                                                              • SHA256 bce1913fc270f2f8aff0e57b95d49cd044f582d11b45debdc3521b464351fd6d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3870112724rsegmnoittet-es.sqlite
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                              • Size 7.3MB
                                                              • SHA256 dbbd4b3efaf269e8bfd5f75f333ba626ad4e1e0c5b0ed7e4a794784e92a25fe3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              3870112724rsegmnoittet-es.sqlite
                                                              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                              • Size 5.4MB
                                                              • SHA256 24c101b0af491e5b5e2c6468355d2231a9988aa22979a176b78e99ee0c2d8b41
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              perfhost.exe
                                                              • Path C:\Windows\SysWOW64\perfhost.exe
                                                              • Size 588KB
                                                              • SHA256 13a3a6c19a47471c5b8c41b37b6a8a2c79b8cc9bbafea4de6bc3addadec87149
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AgentService.exe
                                                              • Path C:\Windows\System32\AgentService.exe
                                                              • Size 1.4MB
                                                              • SHA256 7d54fc59d4c1388f693b1c61cfdd907de7f885f44417f3e2e46382c997b8c617
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ssh-agent.exe
                                                              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                              • Size 1.1MB
                                                              • SHA256 0e552e36ed593b1730c2cabbfd4a36570a38384a31713dce6a46e60d1cd53336
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ReFsDedupSvc.exe
                                                              • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                              • Size 2.6MB
                                                              • SHA256 8ff40c6f496b7cf867a7ce07572f9fa95586abaa82b42f3a21f1fc8ae7badd6f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SearchIndexer.exe
                                                              • Path C:\Windows\System32\SearchIndexer.exe
                                                              • Size 1.4MB
                                                              • SHA256 1200e391029cf443659d8b52ea98ee572ceb4c946becd9df183e7425d53cef97
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SensorDataService.exe
                                                              • Path C:\Windows\System32\SensorDataService.exe
                                                              • Size 1.7MB
                                                              • SHA256 991ee46943036cfbd2a6ac28b1b687d667b197b6eb29c9bd676b830b6c5ef453
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              AppVClient.exe
                                                              • Path C:\Windows\system32\AppVClient.exe
                                                              • Size 1.3MB
                                                              • SHA256 21821b803d32ce3d507567af29eb1718586b8ce060c4b32bd25c82b8cb86df5a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              PerceptionSimulationService.exe
                                                              • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                              • Size 804KB
                                                              • SHA256 79573c667dcee0a12f421dcf5f700b728f02558586138880a19838579dcf7226
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              SgrmBroker.exe
                                                              • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                              • Size 964KB
                                                              • SHA256 8d2ced6d13674515de9cca12d551473899bf472fb3665c754600096eb0351b2f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/1376-75-0x0000000000400000-0x0000000000497000-memory.dmp
                                                              Download

                                                              memory/1376-287-0x0000000000400000-0x0000000000497000-memory.dmp
                                                              Download

                                                              memory/2096-38-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                              Download

                                                              memory/2096-48-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                              Download

                                                              memory/2096-37-0x0000000140000000-0x00000001400D5000-memory.dmp
                                                              Download

                                                              memory/2096-50-0x0000000140000000-0x00000001400D5000-memory.dmp
                                                              Download

                                                              memory/2096-44-0x0000000000C00000-0x0000000000C60000-memory.dmp
                                                              Download

                                                              memory/2516-13-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                              Download

                                                              memory/2516-20-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                              Download

                                                              memory/2516-14-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                              Download

                                                              memory/2516-103-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                              Download

                                                              memory/3152-32-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                              Download

                                                              memory/3152-33-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                              Download

                                                              memory/3152-26-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                              Download

                                                              memory/3152-25-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                              Download

                                                              memory/3152-871-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                              Download

                                                              memory/3152-117-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                              Download

                                                              memory/3152-869-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                              Download

                                                              memory/3376-59-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                              Download

                                                              memory/3376-52-0x0000000140000000-0x00000001400CF000-memory.dmp
                                                              Download

                                                              memory/3376-166-0x0000000140000000-0x00000001400CF000-memory.dmp
                                                              Download

                                                              memory/3376-53-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                              Download

                                                              memory/3416-330-0x0000000140000000-0x000000014013E000-memory.dmp
                                                              Download

                                                              memory/3416-106-0x00000000007F0000-0x0000000000850000-memory.dmp
                                                              Download

                                                              memory/3416-112-0x00000000007F0000-0x0000000000850000-memory.dmp
                                                              Download

                                                              memory/3416-104-0x0000000140000000-0x000000014013E000-memory.dmp
                                                              Download

                                                              memory/3548-65-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                                              Download

                                                              memory/3548-71-0x0000000000CB0000-0x0000000000D10000-memory.dmp
                                                              Download

                                                              memory/3548-270-0x0000000140000000-0x00000001400CB000-memory.dmp
                                                              Download

                                                              memory/3548-63-0x0000000140000000-0x00000001400CB000-memory.dmp
                                                              Download

                                                              memory/3900-79-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                              Download

                                                              memory/3900-779-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                              Download

                                                              memory/3900-302-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                              Download

                                                              memory/3900-86-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                              Download

                                                              memory/3900-80-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                              Download

                                                              memory/3900-778-0x00000000004E0000-0x0000000000540000-memory.dmp
                                                              Download

                                                              memory/4768-118-0x0000000140000000-0x0000000140168000-memory.dmp
                                                              Download

                                                              memory/4768-130-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                              Download

                                                              memory/4768-125-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                              Download

                                                              memory/4768-132-0x0000000140000000-0x0000000140168000-memory.dmp
                                                              Download

                                                              memory/4768-119-0x0000000000CD0000-0x0000000000D30000-memory.dmp
                                                              Download

                                                              memory/5364-0-0x0000000000400000-0x0000000000A81000-memory.dmp
                                                              Download

                                                              memory/5364-1-0x0000000002E00000-0x0000000002E67000-memory.dmp
                                                              Download

                                                              memory/5364-7-0x0000000002E00000-0x0000000002E67000-memory.dmp
                                                              Download

                                                              memory/5364-6-0x0000000002E00000-0x0000000002E67000-memory.dmp
                                                              Download

                                                              memory/5364-78-0x0000000000400000-0x0000000000A81000-memory.dmp
                                                              Download

                                                              memory/5364-1287-0x0000000000400000-0x0000000000A81000-memory.dmp
                                                              Download

                                                              memory/5412-767-0x0000017444B50000-0x0000017444DDB000-memory.dmp
                                                              Download

                                                              memory/5828-135-0x0000000000620000-0x0000000000680000-memory.dmp
                                                              Download

                                                              memory/5828-682-0x0000000140000000-0x0000000140172000-memory.dmp
                                                              Download

                                                              memory/5828-141-0x0000000000620000-0x0000000000680000-memory.dmp
                                                              Download

                                                              memory/5828-134-0x0000000140000000-0x0000000140172000-memory.dmp
                                                              Download

                                                              memory/5840-776-0x000001615C6E0000-0x000001615C736000-memory.dmp
                                                              Download

                                                              memory/5964-619-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                              Download

                                                              memory/5964-638-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                              Download

                                                              memory/5964-319-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                              Download

                                                              memory/5964-98-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                              Download

                                                              memory/5964-92-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                              Download

                                                              memory/5964-91-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                              Download