Overview

overview

8

Static

static

3

4999beade8...0e.exe

windows10-2004-x64

8

4999beade8...0e.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/09/2026, 04:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4999beade8d8da652d7d09987c11624b42ef50433cc0dcc2cefc634f00937e0e.exe
  • Size 11.9MB
  • Sample260905-flexsseq4x
  • SHA256 4999beade8d8da652d7d09987c11624b42ef50433cc0dcc2cefc634f00937e0e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarebootkitdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 16 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4999beade8d8da652d7d09987c11624b42ef50433cc0dcc2cefc634f00937e0e.exe
    "C:\Users\Admin\AppData\Local\Temp\4999beade8d8da652d7d09987c11624b42ef50433cc0dcc2cefc634f00937e0e.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
      "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5720
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5152
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1784
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:600
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          PID:4580
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:5800
      • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
        "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        PID:784
      • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
        "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
          4⤵
          • Loads dropped DLL
          PID:3868
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:1716
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:5684
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:2380
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5716
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
            5⤵
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5672
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27061 -prefMapHandle 1968 -prefMapSize 270140 -ipcHandle 2056 -initialChannelId {24ec61dc-54c1-479c-87e3-61bca2242932} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
              6⤵
                PID:5764
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27097 -prefMapHandle 2452 -prefMapSize 270140 -ipcHandle 2460 -initialChannelId {2b592447-14b7-4a9e-a3b2-a2ed54b0e854} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                6⤵
                  PID:3200
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4004 -prefsLen 25131 -prefMapHandle 4008 -prefMapSize 270140 -jsInitHandle 4012 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4020 -initialChannelId {a482e7a4-4ae6-4dde-b8ea-02e2237365ee} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                  6⤵
                  • Checks processor information in registry
                  PID:4528
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4160 -prefsLen 27238 -prefMapHandle 4164 -prefMapSize 270140 -ipcHandle 4200 -initialChannelId {6558c55a-1faa-4dfd-9a1d-3a272e74bdf5} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                  6⤵
                    PID:6068
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2856 -prefsLen 34858 -prefMapHandle 2860 -prefMapSize 270140 -jsInitHandle 3156 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3144 -initialChannelId {58e3bc39-a3b6-4fa9-8bf6-5d64f4882f7e} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                    6⤵
                    • Checks processor information in registry
                    PID:2472
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5036 -prefsLen 35130 -prefMapHandle 4640 -prefMapSize 270140 -ipcHandle 5064 -initialChannelId {7f3f5512-10d7-4214-bf3b-4cb14e928095} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                    6⤵
                    • Checks processor information in registry
                    PID:7008
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192 -prefsLen 35130 -prefMapHandle 5236 -prefMapSize 270140 -jsInitHandle 5240 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5248 -initialChannelId {a8cf7104-332d-4c80-bddb-0b2f1526b2a6} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                    6⤵
                    • Checks processor information in registry
                    PID:7044
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3372 -prefsLen 33071 -prefMapHandle 5592 -prefMapSize 270140 -jsInitHandle 1600 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5432 -initialChannelId {38f671a0-0060-4e7e-90b4-e813808f54e9} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                    6⤵
                    • Checks processor information in registry
                    PID:6784
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5828 -prefsLen 33071 -prefMapHandle 5832 -prefMapSize 270140 -jsInitHandle 5836 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5844 -initialChannelId {195f3881-6f0b-4a0d-a0fa-c64f6f99d44d} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                    6⤵
                    • Checks processor information in registry
                    PID:6796
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012 -prefsLen 33071 -prefMapHandle 6016 -prefMapSize 270140 -jsInitHandle 6020 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6028 -initialChannelId {40f06e47-ec8b-4e23-bc44-4ce05e45de91} -parentPid 5672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                    6⤵
                    • Checks processor information in registry
                    PID:6808
              • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4776
                • C:\Windows\system32\RUNDLL32.EXE
                  "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                  5⤵
                  • Adds Run key to start application
                  PID:4972
                  • C:\Windows\system32\runonce.exe
                    "C:\Windows\system32\runonce.exe" -r
                    6⤵
                    • Checks processor information in registry
                    PID:916
                    • C:\Windows\System32\grpconv.exe
                      "C:\Windows\System32\grpconv.exe" -o
                      7⤵
                        PID:3804
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:4688
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:5424
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:7108
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:4220
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:6364
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6448
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:6612
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6684
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:6904
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2380
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" start IDMWFP
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5916
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 start IDMWFP
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:7112
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                    5⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2024
                    • C:\Windows\system32\regsvr32.exe
                      /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                      6⤵
                      • Loads dropped DLL
                      PID:4560
                • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                  "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5792
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gndown.com/
              2⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:5488
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe28c6c188,0x7ffe28c6c194,0x7ffe28c6c1a0
                3⤵
                  PID:6104
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17033577725787346263,12219223909251919031,262144 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
                  3⤵
                    PID:4692
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,7370341303984838800,18029688486904137402,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
                    3⤵
                    • System Time Discovery
                    PID:3836
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,398370388097561065,9310286749683310068,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
                    3⤵
                      PID:2928
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,8959922639316089828,15721613367355222605,2097152 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
                      3⤵
                        PID:3324
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,6900680583430136142,1033562328255199115,2097152 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                        3⤵
                          PID:4152
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,2093471732562147732,4839137386216905668,2097152 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
                          3⤵
                            PID:1252
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,6434761930317245102,12272502646580076861,2097152 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:9
                            3⤵
                              PID:6128
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,10294916553025644123,13338498634981097857,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
                              3⤵
                                PID:3672
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5379257313183586659,8739830684301219972,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
                                3⤵
                                  PID:6020
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,16005876702427357802,4972036096799018681,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
                                  3⤵
                                    PID:2692
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,5858235994934659155,11065358354869525488,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
                                    3⤵
                                      PID:6048
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,9825145578224802622,7200434862857976740,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
                                      3⤵
                                        PID:476
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,17590456951710981308,14557961279984972391,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
                                        3⤵
                                          PID:4100
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,10222517150921392056,4952061228013621253,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                          3⤵
                                            PID:4332
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,10222517150921392056,4952061228013621253,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                            3⤵
                                              PID:2824
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,3921023478355040316,11495853324983725819,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
                                              3⤵
                                                PID:5544
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,9200752903463255006,6138433724607229386,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
                                                3⤵
                                                  PID:5244
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15427594904129590377,2589280001814233529,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
                                                  3⤵
                                                    PID:1460
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13051307130145487015,8414630009005189333,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:14
                                                    3⤵
                                                      PID:1108
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,16976645137195850957,7415586325820995978,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
                                                      3⤵
                                                        PID:6436
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,10909176072556589321,7317225048579230124,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                                                        3⤵
                                                          PID:3420
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,11391184073097519429,1860291830804730259,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
                                                          3⤵
                                                            PID:6456
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9594895838205279601,7392704189393627713,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
                                                            3⤵
                                                              PID:6428
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,650855081010423084,7065970672126772646,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
                                                              3⤵
                                                                PID:2444
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,16241374856304847765,16965492373729437827,524288 --field-trial-handle=2268,i,5680472497825901410,7747535109141650162,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:14
                                                                3⤵
                                                                  PID:5312
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:5668
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                1⤵
                                                                  PID:6068
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                  1⤵
                                                                    PID:1184
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3dd4bb45-f87f-be40-b785-3a0a40550de8}\idmwfp.inf" "9" "4fc2928b3" "000000000000019C" "WinSta0\Default" "0000000000000170" "208" "C:\Program Files (x86)\Internet Download Manager"
                                                                    1⤵
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Checks SCSI registry key(s)
                                                                    • Modifies data under HKEY_USERS
                                                                    PID:1452
                                                                  • C:\Windows\system32\DrvInst.exe
                                                                    DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "0000000000000180" "WinSta0\Default"
                                                                    1⤵
                                                                    • Drops file in Drivers directory
                                                                    • Drops file in System32 directory
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5828
                                                                  • C:\Windows\system32\grpconv.exe
                                                                    grpconv -o
                                                                    1⤵
                                                                      PID:5504
                                                                    • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                                                                      "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Writes to the Master Boot Record (MBR)
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies Internet Explorer settings
                                                                      • Modifies registry class
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:6412
                                                                      • C:\Windows\system32\regsvr32.exe
                                                                        C:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                        2⤵
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:6736
                                                                      • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
                                                                        "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:6692
                                                                        • C:\Windows\system32\RUNDLL32.EXE
                                                                          "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
                                                                          3⤵
                                                                          • Adds Run key to start application
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:6764
                                                                          • C:\Windows\system32\runonce.exe
                                                                            "C:\Windows\system32\runonce.exe" -r
                                                                            4⤵
                                                                            • Checks processor information in registry
                                                                            PID:2592
                                                                            • C:\Windows\System32\grpconv.exe
                                                                              "C:\Windows\System32\grpconv.exe" -o
                                                                              5⤵
                                                                                PID:1772
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:7076
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4232
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6176
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:5140
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6208
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6300
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4904
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1320
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3184
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:6552
                                                                          • C:\Windows\SysWOW64\net.exe
                                                                            "C:\Windows\System32\net.exe" start IDMWFP
                                                                            3⤵
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6572
                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                              C:\Windows\system32\net1 start IDMWFP
                                                                              4⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:1036
                                                                          • C:\Windows\SysWOW64\regsvr32.exe
                                                                            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                            3⤵
                                                                            • Loads dropped DLL
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:6440
                                                                            • C:\Windows\system32\regsvr32.exe
                                                                              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                                                                              4⤵
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:6508
                                                                      • C:\Windows\system32\DrvInst.exe
                                                                        DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371\idmwfp.inf" "0" "4fc2928b3" "000000000000019C" "WinSta0\Default"
                                                                        1⤵
                                                                        • Drops file in Drivers directory
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:6672

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Persistence

                                                                            Boot or Logon Autostart Execution

                                                                            1
                                                                            T1547

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Browser Extensions

                                                                            1
                                                                            T1176

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            Component Object Model Hijacking

                                                                            1
                                                                            T1546.015

                                                                            Pre-OS Boot

                                                                            1
                                                                            T1542

                                                                            Bootkit

                                                                            1
                                                                            T1542.003

                                                                            Privilege Escalation

                                                                            Boot or Logon Autostart Execution

                                                                            1
                                                                            T1547

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            Component Object Model Hijacking

                                                                            1
                                                                            T1546.015

                                                                            Defense Evasion

                                                                            Modify Registry

                                                                            3
                                                                            T1112

                                                                            Pre-OS Boot

                                                                            1
                                                                            T1542

                                                                            Bootkit

                                                                            1
                                                                            T1542.003

                                                                            Credential Access

                                                                            Credentials from Password Stores

                                                                            1
                                                                            T1555

                                                                            Credentials from Web Browsers

                                                                            1
                                                                            T1555.003

                                                                            Unsecured Credentials

                                                                            1
                                                                            T1552

                                                                            Credentials In Files

                                                                            1
                                                                            T1552.001

                                                                            Discovery

                                                                            Browser Information Discovery

                                                                            1
                                                                            T1217

                                                                            Peripheral Device Discovery

                                                                            1
                                                                            T1120

                                                                            Query Registry

                                                                            5
                                                                            T1012

                                                                            System Information Discovery

                                                                            4
                                                                            T1082

                                                                            System Location Discovery

                                                                            1
                                                                            T1614

                                                                            System Language Discovery

                                                                            1
                                                                            T1614.001

                                                                            System Time Discovery

                                                                            1
                                                                            T1124

                                                                            Lateral Movement

                                                                            Collection

                                                                            Data from Local System

                                                                            1
                                                                            T1005

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            BookmarkMergedSurfaceOrdering
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            SiteList-Enterprise.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                            • Size 2B
                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Edge Profile.ico
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                            • Size 70KB
                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 2KB
                                                                            • SHA256 c5dbc09ef3c411849782cbd1982abaa842b186c87dc46710a8ac85b57371a342
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            SCT Auditing Pending Reports
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Sdch Dictionaries
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                            • Size 40B
                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 c8d27ee185fbf6114fd9c32a6b7d39840c1f5eb1202bedf75bcdd453b8fbda43
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 e021dea1918186f1e6458db9a5c11eb3583d6039e71859b88cd44971fa65e5e9
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 12KB
                                                                            • SHA256 7403fc2d0679837d890d266b2abae9aefc1f230433b8b92d8d20c24f4baca717
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Secure Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                            • Size 31KB
                                                                            • SHA256 45b214f130b167e7b5a0b8c76364080b70c6a59f0317bb8682541be19d948bd3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            sync_diagnostic.log
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                            • Size 4KB
                                                                            • SHA256 ce39eccbd51e1a04e1924dff5aa3020e721e4959657f06bfd1cc33327bf0f8b1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            OperationConfig
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                            • Size 22KB
                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            OperationConfig~RFe5ab140.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab140.TMP
                                                                            • Size 3KB
                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 33KB
                                                                            • SHA256 540b09729af445de90308c427fc001c09efffd77f5abce8ef8381fba3be1d5da
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 33KB
                                                                            • SHA256 74360404382c4aae3338547e1786cc26737799a041aea24e68dec1d0d32bbe08
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 38KB
                                                                            • SHA256 342d237d346e7c6fb3a3a6cd5056e67ea67b3e058ba9f6e62354095be2498910
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 42KB
                                                                            • SHA256 e42f818574d3c69d68ecedb7b3e63d3f34d7ce9ff9b0b62987126b2aa42626e1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 39KB
                                                                            • SHA256 0fa2433c8dfaea5f4af753b51c8b869442301dbe8ea0dae8f462af42e13b76b6
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 38KB
                                                                            • SHA256 c6e073c175d8486f105629cd67ad0df83653e8e2db5bbb073a232e2a408b4161
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                            • Size 132B
                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                            • Size 252B
                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                            • Size 154KB
                                                                            • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                            • Size 13B
                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                            • Size 132B
                                                                            • SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\cache2\entries\5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
                                                                            • Size 16KB
                                                                            • SHA256 dcf814bfe7731582b28fb2ef42f042e835b79d730507a20a6e338b01dbd5e374
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            webext.sc.lz4
                                                                            • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x9aidq83.default-release\startupCache\webext.sc.lz4
                                                                            • Size 105KB
                                                                            • SHA256 9d19b4a761b91329b5e75e501476ab9a00f476c0b199ea0992e403b774bf7115
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            9f66d65a-16c5-45c1-b42b-1f076766b507.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\9f66d65a-16c5-45c1-b42b-1f076766b507.tmp
                                                                            • Size 1B
                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            IDM0.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM0.tmp
                                                                            • Size 18KB
                                                                            • SHA256 79cf944d4cb41f36e4d5c0c2fd98d35df0f51995633eff73c84477d18c71fcef
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM1.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                                                                            • Size 163KB
                                                                            • SHA256 6f6201b354dbf3c59c3bb0c01cd32264d9f68e0d3ad03b0681f5fbb629c40c83
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM10.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM10.tmp
                                                                            • Size 283B
                                                                            • SHA256 47937f8f34ba56718d4bd3b97bfd9e42468d6b7615c745b7841272a2e3d39e57
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM100.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM100.tmp
                                                                            • Size 427KB
                                                                            • SHA256 1fdb0d5b31e080084c82e0b773dafc7860fa860938b8baef6a4d7f5bde659f73
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM101.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM101.tmp
                                                                            • Size 5KB
                                                                            • SHA256 ea297e912d0cf36f2d973b9259bf8fabf622195d5481a11e7bd30967f213d950
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM102.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM102.tmp
                                                                            • Size 6KB
                                                                            • SHA256 f02e6c6f71d07d992ff20f8e74a28aa5f89c8deb6244b796dc897529bae9edf6
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM103.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM103.tmp
                                                                            • Size 7KB
                                                                            • SHA256 07c8896550fbaa6e8fec792e15d240ded0bcffa258a928c1efd8542ff0385511
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM104.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM104.tmp
                                                                            • Size 6KB
                                                                            • SHA256 da36c077ec7c96128d0e5ee5941fad1f779a58a33652d7190e814a75f8bc29ce
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM105.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM105.tmp
                                                                            • Size 5KB
                                                                            • SHA256 9145cfe47d32cf3e45840ce0344da1d29810ef9d756ecddaebb803c59869e945
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM106.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM106.tmp
                                                                            • Size 760KB
                                                                            • SHA256 96694c5184b89b0a17db9c014bee8ebed7a3345f163bd94168c9a394ffaed1fd
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM107.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM107.tmp
                                                                            • Size 6KB
                                                                            • SHA256 84c92bd8ae5a90294d836851385fbf054b7af4d78744f4542147ac436a2a2644
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM108.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM108.tmp
                                                                            • Size 7KB
                                                                            • SHA256 14d51e3b9f5e68e97ed01a6bb1c598e3e09f9e330a90dbe363d6659ac725f679
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM109.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM109.tmp
                                                                            • Size 7KB
                                                                            • SHA256 9619f587e3ef863b7fd69650dcbc1d655d6062c3f73eaf52aca59754ad856b83
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM11.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM11.tmp
                                                                            • Size 111KB
                                                                            • SHA256 92f60cda7a7395d5d4cace82c7270afac5d1b68a2b7714bb1510058fac23879f
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM110.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM110.tmp
                                                                            • Size 27KB
                                                                            • SHA256 1621fd14dd72dcce8bba2e7f46d656744d2975f8ad94b36d2ade01415f48022a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM111.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM111.tmp
                                                                            • Size 104KB
                                                                            • SHA256 c44fd11a6973f028cff24b016e3cf0ea8af76c4f9f73c7848cbb0deed37218b9
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM112.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM112.tmp
                                                                            • Size 395KB
                                                                            • SHA256 e1a4dea06f184be2357be4c72ac5315776f0dce251c0c7fa5f1fa927da69b9bc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM113.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM113.tmp
                                                                            • Size 736KB
                                                                            • SHA256 d464e8e7c84cb2fc62eacf932e841bbd73c3294a37812ccee7ffbbb9e01572a6
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM114.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM114.tmp
                                                                            • Size 29KB
                                                                            • SHA256 e691ebadd8c6e7a07d9c8c931f4760f9aadd2b151019e4f17a76a1665057c9cb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM115.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM115.tmp
                                                                            • Size 7KB
                                                                            • SHA256 0fcdc63880b2eca559d7840874b1fa06f614bc29950ac0698b9e5b0abda150fa
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM116.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM116.tmp
                                                                            • Size 7KB
                                                                            • SHA256 4fa3de0d3cc3c4bbba684124d895c0f9398b4bf53284d41fdfb4665a78364542
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM117.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM117.tmp
                                                                            • Size 107KB
                                                                            • SHA256 9cfa94b69b654b39fe06ad240dca0b90e5317860a6c69f4cef22c38f097d587a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM118.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM118.tmp
                                                                            • Size 100KB
                                                                            • SHA256 5fdb03efd2c46bb6ac6cf92cffc0760e614e84a7eed312c59956f2cfa8a259be
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM119.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM119.tmp
                                                                            • Size 77KB
                                                                            • SHA256 cc4d2f3698d5b48f3bcecf3a69019a1f26a0f59355a438bd12081398477f1c28
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM12.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM12.tmp
                                                                            • Size 17KB
                                                                            • SHA256 2d7bd6f8453c179516c5b322ae7bb95953c20cc7fba229750da0f3ae9da6e90d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM120.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM120.tmp
                                                                            • Size 14KB
                                                                            • SHA256 2ecb7d7069585538f7b3e3a0387ee5c61a80d2e693eae189850fccd80f27a640
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM121.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM121.tmp
                                                                            • Size 107KB
                                                                            • SHA256 db65ef51d8abda581c13994d13186e1efb3c16879e6475720c841d72d41ebe15
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM122.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM122.tmp
                                                                            • Size 2KB
                                                                            • SHA256 e2222852811b0329b0509a907e91d3014cc2f04b14738f7b243c5a658c926d76
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM123.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM123.tmp
                                                                            • Size 11KB
                                                                            • SHA256 7cbcd19ec17184459c2cacf7b5faa70b22625072f753e0061e9dfc358971d0cf
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM124.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM124.tmp
                                                                            • Size 101KB
                                                                            • SHA256 7ef5b0d823f6b9fd19c7590defdd87b4cda46482fe57a308b6cd55f3e5a5f89c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM125.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM125.tmp
                                                                            • Size 2KB
                                                                            • SHA256 0ac59422dc451304111e6b37283d92298345a377c66d72ca6e100a330261323d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM126.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM126.tmp
                                                                            • Size 38KB
                                                                            • SHA256 dba25a49adb88f675db26d2dc7a0fa9d4a5db2326858cb9d2515f6f34b8e0b65
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM127.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM127.tmp
                                                                            • Size 351B
                                                                            • SHA256 f3af82662cd90b90ce0680bbb1fb8a4b998d63d0baf9bba8170723f53de1650c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM128.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM128.tmp
                                                                            • Size 282B
                                                                            • SHA256 67d8c83b0f7dc40c8987cacaee984fa4646f6d72b9daaae0fe6885687c5e08e1
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM129.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM129.tmp
                                                                            • Size 116KB
                                                                            • SHA256 225fdf1269be2b83549c9da018c1b340b4b4973b6dfcd576ed15424762e0b816
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM13.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM13.tmp
                                                                            • Size 2KB
                                                                            • SHA256 f637a5cba06120ec6c298418510912548f46d2ca0d5d456aa1a7de15abc3292b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM130.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM130.tmp
                                                                            • Size 2KB
                                                                            • SHA256 c32b8827748a47e157a19327d109b47ca63fac76e95e0774fd8a2f8a3c6d8918
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM131.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM131.tmp
                                                                            • Size 107KB
                                                                            • SHA256 1425f4ee30f57ed854248fba10621f4aef9b40cf109a31f46bf635e252010113
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM132.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM132.tmp
                                                                            • Size 2KB
                                                                            • SHA256 0dcc35a27b2e96d641d0db051baa9792de6f8190cb6e274ffb2fe81b8750c4e3
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM133.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM133.tmp
                                                                            • Size 119KB
                                                                            • SHA256 13e9d2fd9d71535c384c92207dbda4d534996c076582d8fbb93a0a4ebbb2b78c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM134.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM134.tmp
                                                                            • Size 2KB
                                                                            • SHA256 e349e8a938c551a732d24b89fee54529c5927256fc20b7224c92ed0888df2b62
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM135.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM135.tmp
                                                                            • Size 98KB
                                                                            • SHA256 35469c7f7d4c6e877a0101091f39ab4dd5abe81b2f6ba200d2c12c3f51614ac3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM136.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM136.tmp
                                                                            • Size 3KB
                                                                            • SHA256 2e6a262ece276654637daf6469c025ec6bb1c9037cbcd2fa62dc7f7602da570e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM137.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM137.tmp
                                                                            • Size 149KB
                                                                            • SHA256 4eef1fc6605ccc0b825f875835cdac67748f735150f35fc01fab35f2a9429f8a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM138.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM138.tmp
                                                                            • Size 3KB
                                                                            • SHA256 e2eb949fd81c262d9295487b7055d951df012c7c27f86289d736a51317e3ec60
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM139.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM139.tmp
                                                                            • Size 88KB
                                                                            • SHA256 e549814b7eff8d22a2ab0df9fc4113b7a1e3e72316531eff7ec01db52af61468
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM14.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM14.tmp
                                                                            • Size 49KB
                                                                            • SHA256 c72c0897eb3f38d0e921fb7c4201631894ef53b6f07015be37f506074ad60978
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM140.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM140.tmp
                                                                            • Size 14KB
                                                                            • SHA256 4d3333604aad2a4888a6c2b665f6e61212398b8cd57ededa9fe1c38770d91e99
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM141.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM141.tmp
                                                                            • Size 14KB
                                                                            • SHA256 912b486f50f6735b9d2c14f5bedfb79647f570e13bbef2354604d350fe1d313f
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM142.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM142.tmp
                                                                            • Size 95KB
                                                                            • SHA256 f91b4aa4e481982de15f6b9fe55da271d36d5fa7253d2ac338f8357636c93a27
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM143.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM143.tmp
                                                                            • Size 95KB
                                                                            • SHA256 3a5c70182a4a31c860295ab2931c34661a3c894dc02623ae6e2a70c9c378bac0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM144.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM144.tmp
                                                                            • Size 4KB
                                                                            • SHA256 05def0184416d4a17d41939008cede16d264fa9c094db77c5edf6749f787d9e4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM145.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM145.tmp
                                                                            • Size 1KB
                                                                            • SHA256 17389fc3e7343e325f694e06b6389a9855e7040176e0092e0c7594d5d7b774f4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM146.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM146.tmp
                                                                            • Size 1KB
                                                                            • SHA256 1487a8fd4a297f7f0ce0ea7f1a2e763c2a09da298bc44c6b5e6c313f99371737
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM147.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM147.tmp
                                                                            • Size 96KB
                                                                            • SHA256 449f23660278b268ce198c7ca7c1988e5aac4aa18928c45282f4f75a89904b66
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM148.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM148.tmp
                                                                            • Size 2KB
                                                                            • SHA256 07423e982aae40e8c780e6fa0d7b69d3c2ec96d3c249cf641caa931dc23915c7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            IDM149.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM149.tmp
                                                                            • Size 329KB
                                                                            • SHA256 f9fe31b640b7d799102b5046b71475a9b574c5c90d5cec4153b48d19d4d8bdef
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM15.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM15.tmp
                                                                            • Size 98KB
                                                                            • SHA256 51884df6595ae8e040e2314f2a4a8781ee750cbc727f0d5cd7c6451c173114e1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM150.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM150.tmp
                                                                            • Size 400KB
                                                                            • SHA256 6ff10a3025e0e74bbe9fd99ea21bdaa20a32c94e13145b8805acc82cf1229f5f
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM151.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM151.tmp
                                                                            • Size 1.7MB
                                                                            • SHA256 487a7532f22a3b3272ea7fd6edef1db2ab79906ff2447505cc5de947d121033e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM152.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM152.tmp
                                                                            • Size 382KB
                                                                            • SHA256 3e652321c10179dff6a5130e379454210500829632c7c5a687cdb599e4cea7fb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDM153.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM153.tmp
                                                                            • Size 11KB
                                                                            • SHA256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            IDMSetup2.log
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                                                                            • Size 4KB
                                                                            • SHA256 4ff66e3c1e781d92abb757f537af13b1fb3fa167b86d330b7ed302728c7da53a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            System.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nsa3669.tmp\System.dll
                                                                            • Size 12KB
                                                                            • SHA256 a2244aba2ac35d9b72ccce1c8fe5897b384d3765e7ea8db147201617d1572bc0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            content_new.js
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5488_1545341634\CRX_INSTALL\content_new.js
                                                                            • Size 10KB
                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            content.js
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5488_1625353632\CRX_INSTALL\content.js
                                                                            • Size 27KB
                                                                            • SHA256 0a9b427f9c1bd844f73c1768b60fdf30bccbef5ce9299a27f4fe11e13348b66d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            tmpaddon
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                            • Size 11KB
                                                                            • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            tmpaddon
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                            • Size 502KB
                                                                            • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            data.safe.tmp
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\db\data.safe.tmp
                                                                            • Size 7KB
                                                                            • SHA256 0ad139039e9ce2b444c821cb97e379b2d3df4cb25bb4d1dbdf2bf0c276394801
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            events
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\events\events
                                                                            • Size 1KB
                                                                            • SHA256 74cf5436759c5bd66e6e57c806682d7674fefabe3192863e0ad1c87fff51546c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            059b7b85-9948-46a7-b5cb-1e0f7f05b9bb
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\059b7b85-9948-46a7-b5cb-1e0f7f05b9bb
                                                                            • Size 15KB
                                                                            • SHA256 214986fd1e09463ff0ecb82d1d3f77c62cd0fa3bbde651a14cef239739618a3a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            1b335df1-0f18-481d-8629-d6767d27fd5e
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\1b335df1-0f18-481d-8629-d6767d27fd5e
                                                                            • Size 883B
                                                                            • SHA256 15f9b9c503006e56602f4a647851952bc6b5945b4f4264be9ab809fc2fa2b62b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            8445f1d1-29a6-4c0e-8400-cfa6c5a01c1c
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\8445f1d1-29a6-4c0e-8400-cfa6c5a01c1c
                                                                            • Size 2KB
                                                                            • SHA256 6e2181904471e688cff2206c870d99728b0f1e578637156de6fd8ac5b0546716
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            aaff845b-1296-4ed6-84bc-024c1a730c86
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\aaff845b-1296-4ed6-84bc-024c1a730c86
                                                                            • Size 886B
                                                                            • SHA256 555b4b517e9f7ad91afdc3cb8743735eb59b5c2b5d6914a7192bd664c8149823
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            c87c9e5c-361b-40bd-9103-2769e1184335
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\c87c9e5c-361b-40bd-9103-2769e1184335
                                                                            • Size 235B
                                                                            • SHA256 744a9e027517c1486fa0884a781b91e38ebc0579189a464c3f6ee2affd29a41d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            ed58bf0b-d592-4c86-831c-43b649fca506
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\datareporting\glean\pending_pings\ed58bf0b-d592-4c86-831c-43b649fca506
                                                                            • Size 235B
                                                                            • SHA256 f196dd8a14d84de5dc469a8938e8086f9437905027c15181f7603488b32b1ee9
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            extensions.json
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\extensions.json
                                                                            • Size 16KB
                                                                            • SHA256 8dd743fb97a10e0fc8ca3ef73e477d04c0499897d88ff7688a2019f2b953f99a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            gmpopenh264.dll
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                            • Size 1.1MB
                                                                            • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            gmpopenh264.info
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                            • Size 116B
                                                                            • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            manifest.json
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                                            • Size 1002B
                                                                            • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            widevinecdm.dll
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                                            • Size 21.6MB
                                                                            • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            prefs-1.js
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
                                                                            • Size 8KB
                                                                            • SHA256 84ce3c97a99e47f509fc92f8956ac4fe5149d8a6ccfe09fe947b82e7ef1f899e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            prefs-1.js
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs-1.js
                                                                            • Size 6KB
                                                                            • SHA256 1396aba2791a3f87cc8b4069800a344f409e8d23898f015bad7c1162a2125124
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            prefs.js
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
                                                                            • Size 6KB
                                                                            • SHA256 a2dbfa686db29beb04995bd6a0d9ab52bcf94c56724df3fae22176a71c0c0d1a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            prefs.js
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\prefs.js
                                                                            • Size 6KB
                                                                            • SHA256 de64c3df5fff9e7ff214fa369164be59f4ea8f7c1cf785507769bddf5cd039cd
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            recovery.baklz4
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\sessionstore-backups\recovery.baklz4
                                                                            • Size 4KB
                                                                            • SHA256 84b53a61bbe815c3e83ac50c51f0f42dd3ec3bc5872502174fc76a2d0884bc0d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            3870112724rsegmnoittet-es.sqlite
                                                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x9aidq83.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                            • Size 6.6MB
                                                                            • SHA256 8c071e5d113f5491f18bbae9e839e56a878d9bfcc5330d67bcb8dec520d740ac
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            idmwfp.inf_amd64_be5722ccff6c2371.ini
                                                                            • Path C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_be5722ccff6c2371.ini
                                                                            • Size 415B
                                                                            • SHA256 7522ff2d441631ca54a7f76347a27d4c388de9dc2aa817cec3443009fbd750b4
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            memory/4776-1766-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                            Download

                                                                            memory/5720-698-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                            Download

                                                                            memory/5720-199-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                            Download

                                                                            memory/6692-1792-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                            Download