Overview

overview

10

Static

static

10

2026-10-16...op.exe

windows10-2004-x64

9

2026-10-16...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 14:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-16_777c32e957d334e5303af6556e769bd6_darkgate_elex_glassworm_remcos_stop.exe
  • Size 7.1MB
  • Sample261017-rmgcssvvhs
  • SHA256 5a5443e1ae0329da9ca97981f797afc00909a80314ce5071ba21fed7dc822418
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencespywarestealertrojanupx

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Uses Verclsid to proxy-execute a COM object 1 TTPs 1 IoCs

    Verclsid is a signed Windows utility that verifies COM shell extensions. It can instantiate specific CLSIDs to execute malicious payloads under a trusted binary.

    defense_evasion
  • Drops file in System32 directory 58 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-16_777c32e957d334e5303af6556e769bd6_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-16_777c32e957d334e5303af6556e769bd6_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5344
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:2428
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5876
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3188
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27097 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2068 -initialChannelId {db7a013e-1394-4756-81eb-705dab7cbf75} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:2620
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2496 -prefsLen 27133 -prefMapHandle 2500 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {a16013ef-62be-43ca-89f6-50d9284d1b87} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:1240
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3976 -prefsLen 25213 -prefMapHandle 3980 -prefMapSize 270279 -jsInitHandle 3984 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3992 -initialChannelId {dde0fbd3-cd37-4bfc-968d-58a837689d83} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:2028
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4192 -prefsLen 27323 -prefMapHandle 4196 -prefMapSize 270279 -ipcHandle 4264 -initialChannelId {0814b189-dc78-415e-86ad-978ab005e4d9} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:6040
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2904 -prefsLen 34822 -prefMapHandle 4684 -prefMapSize 270279 -jsInitHandle 4688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4696 -initialChannelId {e789e8d3-6079-48a4-87da-9630dc8ef145} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:5800
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5264 -prefsLen 34929 -prefMapHandle 5268 -prefMapSize 270279 -ipcHandle 5084 -initialChannelId {610e4f5a-b7c6-4b03-aa43-ead71e94ba10} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6252
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 35062 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4836 -initialChannelId {09e50df6-8aa1-47a8-a3c2-a7a1d5772b43} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6568
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5468 -prefsLen 32952 -prefMapHandle 3100 -prefMapSize 270279 -jsInitHandle 5684 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3204 -initialChannelId {5dbd39ac-e89e-489f-acbe-a20381af6af5} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:7052
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5860 -prefsLen 32952 -prefMapHandle 5864 -prefMapSize 270279 -jsInitHandle 5868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {1122c375-017f-4df4-be86-f9d335d471a9} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:7068
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5896 -prefsLen 32952 -prefMapHandle 3100 -prefMapSize 270279 -jsInitHandle 5468 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5204 -initialChannelId {03f2ea85-a5e3-4e6e-8c0b-a3633effb27d} -parentPid 3188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:7088
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6116
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6148
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6180
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6204
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=642b63
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:6312
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff83b2cc188,0x7ff83b2cc194,0x7ff83b2cc1a0
          3⤵
            PID:4860
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,4710786333352359293,3741178769802084939,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
            3⤵
            • System Time Discovery
            PID:5844
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,2480428141743768434,15686380458519500230,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
            3⤵
              PID:3616
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,7811161219724181490,11553897159164416002,262144 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:2
              3⤵
                PID:5896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,553759601304235167,2005905146571008582,2097152 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
                3⤵
                  PID:1568
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,9321631437752129345,8542201206413087304,2097152 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
                  3⤵
                    PID:4672
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,10433988785648221364,1362889558940961388,2097152 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
                    3⤵
                      PID:6168
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,13567132519261647595,14292500272717486874,2097152 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
                      3⤵
                        PID:6212
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,615219426169738570,5691280217299396679,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
                        3⤵
                          PID:6808
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,2442688249434996675,2558140445509125760,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
                          3⤵
                            PID:3012
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,10468961418320792746,5877949743331612689,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
                            3⤵
                              PID:5268
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,11782135726049207421,5980011591410810592,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
                              3⤵
                                PID:964
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,11782135726049207421,5980011591410810592,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
                                3⤵
                                  PID:904
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17346486866358683019,18170612949190519768,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                  3⤵
                                    PID:6880
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,8399255325780219378,9242345382246613974,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
                                    3⤵
                                      PID:6148
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12511268620334852707,18201180425382806590,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
                                      3⤵
                                        PID:7280
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,2550159174169714175,17758206659249393462,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
                                        3⤵
                                          PID:7288
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15263406762742771299,5622580467883330660,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
                                          3⤵
                                            PID:7300
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,3372979180364521665,16453536794625756956,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
                                            3⤵
                                              PID:7912
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13132643752572147783,6239929529925852960,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
                                              3⤵
                                                PID:5596
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8630038522486564427,6973725952534796909,524288 --field-trial-handle=2536,i,14053466608295461618,17065411162263509195,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
                                                3⤵
                                                  PID:7380
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5344 -s 2144
                                                2⤵
                                                • Program crash
                                                PID:3396
                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Reads the TCP/IP host and domain name from the registry
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4296
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              PID:3272
                                            • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                              "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              PID:5416
                                            • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                              "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              PID:5600
                                            • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:3688
                                            • C:\Windows\SysWow64\perfhost.exe
                                              C:\Windows\SysWow64\perfhost.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:252
                                            • C:\Windows\System32\ReFsDedupSvc.exe
                                              C:\Windows\System32\ReFsDedupSvc.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Checks processor information in registry
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3440
                                            • C:\Windows\System32\SensorDataService.exe
                                              C:\Windows\System32\SensorDataService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • Checks SCSI registry key(s)
                                              PID:2920
                                            • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              C:\Windows\System32\OpenSSH\ssh-agent.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:4664
                                            • C:\Windows\system32\AgentService.exe
                                              C:\Windows\system32\AgentService.exe
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1696
                                            • C:\Windows\system32\SearchIndexer.exe
                                              C:\Windows\system32\SearchIndexer.exe /Embedding
                                              1⤵
                                              • Executes dropped EXE
                                              • Enumerates connected drives
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:4412
                                              • C:\Windows\System32\SearchProtocolHost.exe
                                                "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:1172
                                              • C:\Windows\System32\SearchProtocolHost.exe
                                                "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                2⤵
                                                  PID:2736
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:6232
                                                • C:\Windows\System32\SearchFilterHost.exe
                                                  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                  2⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:6336
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                1⤵
                                                  PID:3044
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5344 -ip 5344
                                                  1⤵
                                                    PID:6812
                                                  • C:\Windows\system32\verclsid.exe
                                                    "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                    1⤵
                                                    • Uses Verclsid to proxy-execute a COM object
                                                    PID:7952

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Browser Extensions

                                                        1
                                                        T1176

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Defense Evasion

                                                        Modify Registry

                                                        3
                                                        T1112

                                                        System Binary Proxy Execution

                                                        1
                                                        T1218

                                                        Verclsid

                                                        1
                                                        T1218.012

                                                        Credential Access

                                                        Credentials from Password Stores

                                                        1
                                                        T1555

                                                        Credentials from Web Browsers

                                                        1
                                                        T1555.003

                                                        Unsecured Credentials

                                                        1
                                                        T1552

                                                        Credentials In Files

                                                        1
                                                        T1552.001

                                                        Discovery

                                                        Browser Information Discovery

                                                        1
                                                        T1217

                                                        Peripheral Device Discovery

                                                        2
                                                        T1120

                                                        Query Registry

                                                        5
                                                        T1012

                                                        System Information Discovery

                                                        6
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        System Network Configuration Discovery

                                                        1
                                                        T1016

                                                        System Time Discovery

                                                        1
                                                        T1124

                                                        Lateral Movement

                                                        Collection

                                                        Data from Local System

                                                        1
                                                        T1005

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        elevation_service.exe
                                                        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                        • Size 2.7MB
                                                        • SHA256 40ab64ea55c9f01f4c81a2893166aea2eb286ace7083ecab8543dd1761b395e7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        maintenanceservice.exe
                                                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                        • Size 2.2MB
                                                        • SHA256 944673c9c0d8c618d02d35cdd06940d8d2e437bbf96392a9f537a968e5c9f78a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        maintenanceservice.exe
                                                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                        • Size 2.2MB
                                                        • SHA256 0e508b58596c4b49bbccc92eb4dcda65e06ea1e501f9dbc004d5bc8a857273c5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        maintenanceservice.exe
                                                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                        • Size 1.5MB
                                                        • SHA256 fa6c0fdf56edd98271279d91087461400a6c9e92f87fecccc21ffb71757ba1ca
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        LICLUA.EXE
                                                        • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                        • Size 1.8MB
                                                        • SHA256 c56d653614947535b81ca569fd50aa60fc8ddace08b5c51c31f4e99b5468ee8c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        OSE.EXE
                                                        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                        • Size 1.5MB
                                                        • SHA256 606b1d0f4c17bec7ed151618e5da2ee8bb7261a6805d13e39cea79e2c9345124
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        VSTOInstaller.exe
                                                        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                        • Size 2.1MB
                                                        • SHA256 a44d4dc99baa43e76e8802efc28465d6e7f64994331e2609d749b38aff072105
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        chrome_pwa_launcher.exe
                                                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                                        • Size 3.0MB
                                                        • SHA256 ec6cf1ad492e23776dc01aa8c7bb234179fa01d19fa3dfcc8511ce552c97348b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        elevated_tracing_service.exe
                                                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
                                                        • Size 4.7MB
                                                        • SHA256 61e6a4f4e0335312b0aacfeef5435af51a1fba8d45c4cae3ee679d7613feb82c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        elevation_service.exe
                                                        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                        • Size 2.8MB
                                                        • SHA256 8dcc985f218b7e352eb97935e1495d877527a967e400f0d4b75109407e2753a1
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        firefox.exe
                                                        • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                        • Size 1.2MB
                                                        • SHA256 5c7ad58ec74eb207f4d446e6f198665b0266f75109737db64539aae8afc59cf5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        MsSense.exe
                                                        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                        • Size 2.4MB
                                                        • SHA256 09ce2a94b3f066486bb29c72b56f1efe64bceaf27d3495a1f4bfd49b8eb6e1ee
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        NisSrv.exe
                                                        • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                        • Size 4.3MB
                                                        • SHA256 eece4e95d5144f7b0c5ef79a93c0d3f8a1fd5cba5af88dab949aaf0f7ea3a2b7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        NisSrv.exe
                                                        • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                        • Size 3.5MB
                                                        • SHA256 1d3a05cb268c060c2e54fbb609e7ffe518fe53aafa19335e390b7a6bdb71fcb7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        wmpnetwk.exe
                                                        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                        • Size 2.2MB
                                                        • SHA256 b967495774f90ee39135bb72384f4c3ef69b3b289d6bd14e03ad3169142244fd
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        wmpnetwk.exe
                                                        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                        • Size 1.4MB
                                                        • SHA256 5494e3fd87039b257fe776192b143b8dfccc8ea2bc28718aa7fc77a18888b2f4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        dotnet.exe
                                                        • Path C:\Program Files\dotnet\dotnet.exe
                                                        • Size 2.1MB
                                                        • SHA256 528671d4cac48399424d1369bb3410a5b24b96cc27d201695af7c46e007abd8a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Windows.db
                                                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                        • Size 1.3MB
                                                        • SHA256 6db04a8db17efe76c0a563a03eb5f6b2624c728826c697c8a6158f21b558c05b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Windows.db-wal
                                                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                        • Size 16KB
                                                        • SHA256 50de5651014a8b8406128c032942ae3109558f25646e9b3d1d40c820142ff272
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        Windows.db-wal
                                                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                        • Size 333KB
                                                        • SHA256 a5c58ad6e9d0365edd43edb7b52726249fd009d372a4edd7254882582c5a2d28
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        5f02d26b-f0fa-4b48-8dc4-a18f22e3eeff.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f02d26b-f0fa-4b48-8dc4-a18f22e3eeff.tmp
                                                        • Size 37KB
                                                        • SHA256 a724f7ffa4c51b8f4c0724dfa7eb1003ab2cd06d817dc45a9a200be860807cfa
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 97f58c0ff1008d9a744980b06de74b1bc42fdd2408c0871566ecacc80738c498
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        settings.dat
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                        • Size 280B
                                                        • SHA256 355a29997d085f70c135b61fb8e48fe3b3d9b6030190662c9d930bd533b88c78
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        021dc08f-b4f3-4302-955b-a8cdef2ed381.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\021dc08f-b4f3-4302-955b-a8cdef2ed381.tmp
                                                        • Size 27KB
                                                        • SHA256 332af85160c2bee8f4c153457be9aba1047779555f7860447bb0ccfa3221aa0c
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        40b4c97e-564b-435e-b22b-e8555f5e0dbb.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\40b4c97e-564b-435e-b22b-e8555f5e0dbb.tmp
                                                        • Size 12KB
                                                        • SHA256 a05b29744d4e571e66eb36032657cfc51dc29af28d009b1a407e3f12c0a99741
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        7ed670b3-b51a-44a0-b6d9-694818e376d5.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7ed670b3-b51a-44a0-b6d9-694818e376d5.tmp
                                                        • Size 70KB
                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        temp-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                        • Size 3KB
                                                        • SHA256 4148d030c8d498c7dbfb4a03de2385e76a27a83f5f09420ebeb4fa858c002e95
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        the-real-index
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        • Size 3KB
                                                        • SHA256 b975f03693411c5019784f9c067f2fcb308e3ef068c7032bb47728efd48bc94f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        151e7933-4831-4e53-9602-c7693a31c288.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\151e7933-4831-4e53-9602-c7693a31c288.tmp
                                                        • Size 2B
                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        0608818d-e465-48b0-83be-d5a52b0e6f24.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0608818d-e465-48b0-83be-d5a52b0e6f24.tmp
                                                        • Size 2KB
                                                        • SHA256 b84394af5ed74b317461a0f129b6dce49ed5b093acfb558d981d93691f6f5ce7
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        5b571851-49ef-4cbc-8430-431385590616.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b571851-49ef-4cbc-8430-431385590616.tmp
                                                        • Size 2B
                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        5d4b852a-c0d5-4cfa-baf7-e4889d84157e.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d4b852a-c0d5-4cfa-baf7-e4889d84157e.tmp
                                                        • Size 40B
                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        b37b4118-e6ed-403e-8c41-408277ef7629.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b37b4118-e6ed-403e-8c41-408277ef7629.tmp
                                                        • Size 12KB
                                                        • SHA256 22ca5ced19a8040e96853ace8d4b00034d78ee18e269d9fda96b58755dd07203
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        d26d7a96-1213-4817-809e-1071adfe8774.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d26d7a96-1213-4817-809e-1071adfe8774.tmp
                                                        • Size 11KB
                                                        • SHA256 0209cac2d2f3a394b3b8461fac536f2a486dd72d0a2b6743dbde4cce920e6c7e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        fddd4df2-c0a0-429e-a495-b8092b6f7a1b.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fddd4df2-c0a0-429e-a495-b8092b6f7a1b.tmp
                                                        • Size 11KB
                                                        • SHA256 5f6e399e57e444a9ac73d05eec38d1df406e27a348379f16f2cc5735c1c04dc3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        OperationConfig
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                        • Size 3KB
                                                        • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        OperationConfig
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                        • Size 22KB
                                                        • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        abd379c5-d395-4034-9427-26dc861a21da.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\abd379c5-d395-4034-9427-26dc861a21da.tmp
                                                        • Size 34KB
                                                        • SHA256 1bb9bb80e7030f5897fd3bb302872d36efa1181060010a473e50bbfff4a4d5da
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ac833af7-ac8e-4feb-916e-1fb3b66e4603.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac833af7-ac8e-4feb-916e-1fb3b66e4603.tmp
                                                        • Size 38KB
                                                        • SHA256 0058c2333bb01c5326ee61b7cb0a71b34071f819d436588d38531accce8d4221
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        bb6a44bf-e4cd-4176-be28-63b198268998.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb6a44bf-e4cd-4176-be28-63b198268998.tmp
                                                        • Size 37KB
                                                        • SHA256 fbd18a7bad607f4ae30f6a870c835b1edcead32c63639b52f90b08096eb54855
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        300e78d9-83a6-45db-9e45-68cbd95941c3.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\300e78d9-83a6-45db-9e45-68cbd95941c3.tmp
                                                        • Size 132B
                                                        • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        e354d37e-fa75-42fc-884c-16cf382639fb.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e354d37e-fa75-42fc-884c-16cf382639fb.tmp
                                                        • Size 39KB
                                                        • SHA256 af4ec4516782b3e3313eff98f09d28ebb81f23c76471f1309958084012292d41
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ee3ece17-50a6-4d19-84cb-3edae0ec8078.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee3ece17-50a6-4d19-84cb-3edae0ec8078.tmp
                                                        • Size 34KB
                                                        • SHA256 4b66ae8faa9cf5f78fc36d18e4dceb61d9fcc2796c167d523e70ffe46d86fe0d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        42fa3980-23b6-4b9b-82f5-a6b73258f99f.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42fa3980-23b6-4b9b-82f5-a6b73258f99f.tmp
                                                        • Size 13B
                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        activity-stream.contile.json
                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.contile.json
                                                        • Size 4KB
                                                        • SHA256 7d988d88084b56b53d596461f4917b81699771465ba146713000bea1eabc51fb
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        activity-stream.discovery_stream.json
                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\activity-stream.discovery_stream.json
                                                        • Size 75KB
                                                        • SHA256 3b407156ca399a319f01789cfbbc0063939f9ed5b701ddbd4934e030d3a107b2
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        E9338C5CCF1E2FCF149487351399F198A4F9FCD6
                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\cache2\entries\E9338C5CCF1E2FCF149487351399F198A4F9FCD6
                                                        • Size 16KB
                                                        • SHA256 a384501977f4016a5246d16ee1c786eb128bff1ee7e0f6b1d15f1dfcc57a8691
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        webext.sc.lz4
                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
                                                        • Size 104KB
                                                        • SHA256 4e73e5d48bd7d0df74882455b802315eb34b9bc80f270155110e67ef750c1aab
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        webext.sc.lz4
                                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xoeudfhc.default-release\startupCache\webext.sc.lz4
                                                        • Size 105KB
                                                        • SHA256 d519cb8953a705308b89b5a781da79836f866c7e10556bc8c1d0b4d06a0f1010
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        58325d58-9807-4de0-9f20-aba90c788041.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\58325d58-9807-4de0-9f20-aba90c788041.tmp
                                                        • Size 10KB
                                                        • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        93847fba-d5f6-4333-bf0e-3e3af68e5bd1.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\93847fba-d5f6-4333-bf0e-3e3af68e5bd1.tmp
                                                        • Size 1B
                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        content.js
                                                        • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6312_1835120465\CRX_INSTALL\content.js
                                                        • Size 9KB
                                                        • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        tmpaddon
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                        • Size 11KB
                                                        • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        tmpaddon
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                        • Size 502KB
                                                        • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        tmpaddon
                                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                        • Size 21.6MB
                                                        • SHA256 7b81444b063f81e77c527c5589e86836cc2f7328deb2772300ccc7dc9e2510c3
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        addonStartup.json.lz4
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\addonStartup.json.lz4
                                                        • Size 4KB
                                                        • SHA256 a3322d83488a4993dcd984c195c4fedd6a0292b2171d1ce38c09ed77a8180d05
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        broadcast-listeners.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\broadcast-listeners.json
                                                        • Size 221B
                                                        • SHA256 cd2cc576789564e880e38a1805f3b47b3ce38c23cfc87c0cd046630655b5e5dc
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        compatibility.ini
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\compatibility.ini
                                                        • Size 198B
                                                        • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        store.json.mozlz4
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\crashes\store.json.mozlz4
                                                        • Size 66B
                                                        • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        data.safe.tmp
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                        • Size 6KB
                                                        • SHA256 9696bda5a8df4f7d6587eb5f3950db0896538e2aef548f3a2ad69823c56c6d8b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        data.safe.tmp
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                        • Size 7KB
                                                        • SHA256 9870d04fe563d2d4dcfcf60931b3f27f13c42ab9d87c39dcb254f73a27e6ae83
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        data.safe.tmp
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                        • Size 7KB
                                                        • SHA256 13f33dfb0a222c1db49f12a5407a2467e65f5c583e9a5f926363b5b2d0b79645
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        data.safe.tmp
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                        • Size 34KB
                                                        • SHA256 724fadf3e6a8c2d2fb572f52681ab45b710b051d36be72c63a28565e55493258
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        data.safe.tmp
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                        • Size 34KB
                                                        • SHA256 15027714e2a60ba399adf01bd6565211395ed31710718bce7fa53bbd23f2168e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        data.safe.tmp
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\db\data.safe.tmp
                                                        • Size 34KB
                                                        • SHA256 79c87604996ae31da7e6139c38ae0f464163a4682ead68b19b1e04d89c328373
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        events
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
                                                        • Size 2KB
                                                        • SHA256 1cf5f5826c879d3d05edb36e7ecafb3472ffba332bf35145ce00bdb555770ca6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        events
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\events\events
                                                        • Size 1KB
                                                        • SHA256 47905d22a3a068ef727a9a23adef3b8228f349acb09e61382cd4cfb4c1fd4da2
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        7617dfcf-a571-4357-84f5-256345f1c6f9
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\7617dfcf-a571-4357-84f5-256345f1c6f9
                                                        • Size 2KB
                                                        • SHA256 f3125b42f269ab7d608bf61217a130a8c19d1c3b13fd1bb4e68d9566a6e64dd5
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        b5668759-fb7e-416a-af19-5c59e0ce37dd
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\b5668759-fb7e-416a-af19-5c59e0ce37dd
                                                        • Size 16KB
                                                        • SHA256 992d323761ad04eee0be924ca6401b874b9f7e4f9ae83ab757277a2d6a58d8e8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        c614fd68-12e2-4665-9171-811f1758419b
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\c614fd68-12e2-4665-9171-811f1758419b
                                                        • Size 883B
                                                        • SHA256 5d5c655dc9e67c2b7d710bfd60562f3fd554fb2a9e7f5a0033df4acddb66cbf5
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        d1e57700-9445-4911-ad40-c526239a3eed
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\d1e57700-9445-4911-ad40-c526239a3eed
                                                        • Size 235B
                                                        • SHA256 178c61f74cf7f7a99052b6707ee11393a358f073f5961e08eebea7ca20bcc82b
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        d2e1f5f2-5436-4696-b154-cef1c9390bf6
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\d2e1f5f2-5436-4696-b154-cef1c9390bf6
                                                        • Size 886B
                                                        • SHA256 0825c0d64c992b914a91322ffa78e1cf7e51ad99478fdb541269b5bd4676b72a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        e8bf1889-c820-4f5c-be9d-4f86a73b14f8
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\datareporting\glean\pending_pings\e8bf1889-c820-4f5c-be9d-4f86a73b14f8
                                                        • Size 235B
                                                        • SHA256 007c8bac2953743e6d5fdb7923a1dc9c9455c21d77cf280eca7c7725fea4555a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        extension-preferences.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extension-preferences.json
                                                        • Size 942B
                                                        • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        extensions.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\extensions.json
                                                        • Size 14KB
                                                        • SHA256 a2e21f6b1af114d61328e7decb2a1b15d63ce8587e88f19a3b4a1f892427f15e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        gmpopenh264.dll
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                        • Size 1.1MB
                                                        • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        gmpopenh264.info
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                        • Size 116B
                                                        • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        LICENSE
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\LICENSE
                                                        • Size 473B
                                                        • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        manifest.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                                                        • Size 1002B
                                                        • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        widevinecdm.dll
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                                                        • Size 21.6MB
                                                        • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        widevinecdm.dll.sig
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll.sig
                                                        • Size 1KB
                                                        • SHA256 c5f50bed6afd38490baca2ce8e8fdd1a39849c9f0dc06478a8a2e9226526607b
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        prefs-1.js
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
                                                        • Size 6KB
                                                        • SHA256 d4f6ce664a09e61a6b2897e804174ff72d0a4ac6ff38a331d9fbfcceef9ce486
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        prefs-1.js
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs-1.js
                                                        • Size 6KB
                                                        • SHA256 fb7b703ae7f1e74e94ba2e56e1f4d5197c4c916fe9cf6bdff543293db14a0212
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        prefs.js
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                                                        • Size 6KB
                                                        • SHA256 b07e960d7c4d39925dd18baadced539b6e2c0af1e3e78ced2f9f06ff96c3dacb
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        prefs.js
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\prefs.js
                                                        • Size 8KB
                                                        • SHA256 943d2d6e3d367fac526fc1191a9206dc7302a53161b8e1b99ce6317091867294
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        sessionCheckpoints.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
                                                        • Size 53B
                                                        • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        sessionCheckpoints.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionCheckpoints.json
                                                        • Size 90B
                                                        • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        recovery.jsonlz4
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
                                                        • Size 4KB
                                                        • SHA256 b63c3dafe267a036dfa95686fc94c1252997fca5ad58be1f2549db93c7c647e2
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        recovery.jsonlz4
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\sessionstore-backups\recovery.jsonlz4
                                                        • Size 4KB
                                                        • SHA256 ce3ac35aeb34aba77ed1a48a245698fb365292ed11015668dc653a3c94bb7df4
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 6.4MB
                                                        • SHA256 b93df7b44421c8369e8afef2ce040aca1a07c3dbfe5619372127940346f2002e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 6e494504986e0354d9bcc07b74b5ea56bc973f6d4d0eecec5b4830e00b21f4e0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 c5d2875720d45cb13551f6300d18229eb0c1f34760adef53508803579d05dd3f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 738fc46a9d364799857b638f54dd995c7a5cc1b2c14d56d6e1c2577e2bd53312
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 f7df91e493cf4316b47e7379ba1eb00c2ad74581c4b27c7ed5e80b1f88623091
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 e661e51cd08795799b6cb5629b7ecf4b1e5915a9edccb7b67b8694c49697f224
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 43c8d7229e4d6e6814663cf1ac386ceb57b5e5cc949fb47422d84d7d70b10f49
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 7.5MB
                                                        • SHA256 f46bb2937ecb4b5c236088032fda6cdacbfd86e8160d8965ded6cc3c0ebde24f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        3870112724rsegmnoittet-es.sqlite
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        • Size 5.5MB
                                                        • SHA256 4ac800831045067580f6a1b50195c026d879d389b6010c0ac4661a3ff97a119b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        targeting.snapshot.json
                                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xoeudfhc.default-release\targeting.snapshot.json
                                                        • Size 3KB
                                                        • SHA256 ae35967735d60d900fb5d14d3cce4fb7c196130ca9f52cb27c98a1b4a312ba42
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        perfhost.exe
                                                        • Path C:\Windows\SysWOW64\perfhost.exe
                                                        • Size 1.2MB
                                                        • SHA256 5cea266c2858eb91abd8d269503a81e5524e64c018167139a85ec36c3d5a9079
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        AgentService.exe
                                                        • Path C:\Windows\System32\AgentService.exe
                                                        • Size 1.4MB
                                                        • SHA256 05026d7176fdda3de137fae604281615d1bb115ff872421b04888936e6ad5c09
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        AgentService.exe
                                                        • Path C:\Windows\System32\AgentService.exe
                                                        • Size 2.1MB
                                                        • SHA256 d4155844cd34577b2ece71a88bbe88d0ee9cfa781d43d58a1cacf53fab04761a
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        GameInputSvc.exe
                                                        • Path C:\Windows\System32\GameInputSvc.exe
                                                        • Size 828KB
                                                        • SHA256 07c4142714d8a7c83981b863acd854e974e11951c1dbde3a0ff7408a26fc5198
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ssh-agent.exe
                                                        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                        • Size 1.8MB
                                                        • SHA256 30556a983c0617894d6217725004148998a1909dfaa71f57f63ce4dc2968644f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ReFsDedupSvc.exe
                                                        • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                        • Size 2.6MB
                                                        • SHA256 515c0752324d6d6efa8987dd0a9c5958680da288c6d9c71273f1b9741a13f327
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        SearchIndexer.exe
                                                        • Path C:\Windows\System32\SearchIndexer.exe
                                                        • Size 1.4MB
                                                        • SHA256 4528c66decebdea017fd07e29f164e4562240e7cf48ba18714803b3c6fce836b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        SensorDataService.exe
                                                        • Path C:\Windows\System32\SensorDataService.exe
                                                        • Size 1.7MB
                                                        • SHA256 7ec681e397ab07273194fd89a8d4f996648781fa4f9b55d57feea1fed08ff9a8
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        SgrmBroker.exe
                                                        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
                                                        • Size 2.4MB
                                                        • SHA256 9c51c0ac0b2b64adc79b72df37ef91ed29ccc1f2828f8406470638687ccfd1c9
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        alg.exe
                                                        • Path C:\Windows\System32\alg.exe
                                                        • Size 944KB
                                                        • SHA256 342199dfa8c5cd912fe1e4d663763ec5f45725c8a1e1ed4ecf14e1ae968f346f
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        msdtc.exe
                                                        • Path C:\Windows\System32\msdtc.exe
                                                        • Size 928KB
                                                        • SHA256 8ab0c55fccd2e14e5757cad50284d79823faf4cf67b2b99e681f1bddcd1bf5f5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        snmptrap.exe
                                                        • Path C:\Windows\System32\snmptrap.exe
                                                        • Size 800KB
                                                        • SHA256 101bd0faec4f694b7537a0c8937c49d7e090a4803930adaeb4e16ee0d1020457
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        vds.exe
                                                        • Path C:\Windows\System32\vds.exe
                                                        • Size 1.4MB
                                                        • SHA256 e250142ca347ea4048b6f6d3827f82ae477251cf0a6a14f78da55eae6779c698
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        manifest.json
                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6312_1603548908\manifest.json
                                                        • Size 43B
                                                        • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        manifest.json
                                                        • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6312_2108787083\manifest.json
                                                        • Size 135B
                                                        • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        AgentService.exe
                                                        • Path C:\Windows\system32\AgentService.exe
                                                        • Size 2.1MB
                                                        • SHA256 4d66d66badf6d9bf52fe331e7ec336d72f4066d3e4c906bc355477e56b1df725
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        AppVClient.exe
                                                        • Path C:\Windows\system32\AppVClient.exe
                                                        • Size 1.5MB
                                                        • SHA256 ccb24621411c6e8bd546fe8af8341f641c9b9bc4a2081cfda8d4674b657a3fcc
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        PerceptionSimulationService.exe
                                                        • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                        • Size 1.5MB
                                                        • SHA256 40cf34967de83a583eb097b8c791407aa395d7c605fa8a8edbea5aeda8560e49
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        TieringEngineService.exe
                                                        • Path C:\Windows\system32\TieringEngineService.exe
                                                        • Size 1.1MB
                                                        • SHA256 892d91110eedbbafbefe4e6412b932c626eaad6499a89e515184a07f16f5c56e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        locator.exe
                                                        • Path C:\Windows\system32\locator.exe
                                                        • Size 792KB
                                                        • SHA256 3bb0774c3dcf75134f56873d355016a0b2ccd070a3de4c1d0d67ad23734ad1f0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        msiexec.exe
                                                        • Path C:\Windows\system32\msiexec.exe
                                                        • Size 936KB
                                                        • SHA256 29d0cdca11383bc84444c71964ade10ea18cd9a625f85da84e5a347ebdd17b07
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        vssvc.exe
                                                        • Path C:\Windows\system32\vssvc.exe
                                                        • Size 2.1MB
                                                        • SHA256 a640436a705cb58ee428bfa91507aada5450ab1ee72bf8ca420feb767f8ecbd0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        WmiApSrv.exe
                                                        • Path C:\Windows\system32\wbem\WmiApSrv.exe
                                                        • Size 960KB
                                                        • SHA256 eb046b9754994f8058a4d19b5ec4d7362872cdfa807de54742c25a37852d657d
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        wbengine.exe
                                                        • Path C:\Windows\system32\wbengine.exe
                                                        • Size 2.2MB
                                                        • SHA256 7978e5410151a334827497448a26a11d1eefedf48894687f5446e78bafaca4e6
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        memory/252-357-0x0000000000400000-0x00000000005EE000-memory.dmp
                                                        Download

                                                        memory/252-95-0x0000000000960000-0x00000000009C6000-memory.dmp
                                                        Download

                                                        memory/252-89-0x0000000000400000-0x00000000005EE000-memory.dmp
                                                        Download

                                                        memory/252-90-0x0000000000960000-0x00000000009C6000-memory.dmp
                                                        Download

                                                        memory/1696-161-0x0000000140000000-0x0000000140168000-memory.dmp
                                                        Download

                                                        memory/1696-144-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                        Download

                                                        memory/1696-137-0x0000000140000000-0x0000000140168000-memory.dmp
                                                        Download

                                                        memory/1696-159-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                        Download

                                                        memory/1696-138-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                        Download

                                                        memory/2920-356-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                        Download

                                                        memory/2920-112-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                        Download

                                                        memory/2920-111-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                        Download

                                                        memory/2920-354-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                        Download

                                                        memory/2920-118-0x0000000000780000-0x00000000007E0000-memory.dmp
                                                        Download

                                                        memory/3272-930-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                        Download

                                                        memory/3272-934-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                        Download

                                                        memory/3272-47-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                        Download

                                                        memory/3272-45-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                        Download

                                                        memory/3272-39-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                        Download

                                                        memory/3272-136-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                        Download

                                                        memory/3272-46-0x00000000006E0000-0x0000000000740000-memory.dmp
                                                        Download

                                                        memory/3440-100-0x00000000007F0000-0x0000000000850000-memory.dmp
                                                        Download

                                                        memory/3440-106-0x00000000007F0000-0x0000000000850000-memory.dmp
                                                        Download

                                                        memory/3440-99-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                        Download

                                                        memory/3440-885-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                        Download

                                                        memory/3440-883-0x00000000007F0000-0x0000000000850000-memory.dmp
                                                        Download

                                                        memory/3440-358-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                        Download

                                                        memory/3688-79-0x0000000000B50000-0x0000000000BB0000-memory.dmp
                                                        Download

                                                        memory/3688-77-0x0000000140000000-0x0000000140222000-memory.dmp
                                                        Download

                                                        memory/3688-85-0x0000000000B50000-0x0000000000BB0000-memory.dmp
                                                        Download

                                                        memory/3688-353-0x0000000140000000-0x0000000140222000-memory.dmp
                                                        Download

                                                        memory/4296-35-0x0000000000980000-0x00000000009E0000-memory.dmp
                                                        Download

                                                        memory/4296-26-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                        Download

                                                        memory/4296-27-0x0000000000980000-0x00000000009E0000-memory.dmp
                                                        Download

                                                        memory/4296-123-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                        Download

                                                        memory/4412-164-0x0000000000620000-0x0000000000680000-memory.dmp
                                                        Download

                                                        memory/4412-170-0x0000000000620000-0x0000000000680000-memory.dmp
                                                        Download

                                                        memory/4412-163-0x0000000140000000-0x0000000140172000-memory.dmp
                                                        Download

                                                        memory/4412-392-0x0000000140000000-0x0000000140172000-memory.dmp
                                                        Download

                                                        memory/4664-124-0x0000000140000000-0x0000000140295000-memory.dmp
                                                        Download

                                                        memory/4664-132-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                        Download

                                                        memory/4664-386-0x0000000140000000-0x0000000140295000-memory.dmp
                                                        Download

                                                        memory/4664-126-0x0000000000890000-0x00000000008F0000-memory.dmp
                                                        Download

                                                        memory/5344-8-0x0000000000400000-0x00000000017DA000-memory.dmp
                                                        Download

                                                        memory/5344-1219-0x0000000000400000-0x00000000017DA000-memory.dmp
                                                        Download

                                                        memory/5344-13-0x0000000004A20000-0x0000000004A86000-memory.dmp
                                                        Download

                                                        memory/5344-18-0x0000000004A20000-0x0000000004A86000-memory.dmp
                                                        Download

                                                        memory/5344-61-0x0000000000400000-0x00000000017DA000-memory.dmp
                                                        Download

                                                        memory/5344-6-0x0000000003DA0000-0x0000000003E25000-memory.dmp
                                                        Download

                                                        memory/5344-0-0x0000000003C00000-0x0000000003D97000-memory.dmp
                                                        Download

                                                        memory/5344-1-0x0000000003DA0000-0x0000000003E25000-memory.dmp
                                                        Download

                                                        memory/5416-51-0x0000000001B30000-0x0000000001B90000-memory.dmp
                                                        Download

                                                        memory/5416-57-0x0000000001B30000-0x0000000001B90000-memory.dmp
                                                        Download

                                                        memory/5416-63-0x0000000001B30000-0x0000000001B90000-memory.dmp
                                                        Download

                                                        memory/5416-62-0x0000000140000000-0x000000014022C000-memory.dmp
                                                        Download

                                                        memory/5600-345-0x0000000140000000-0x0000000140226000-memory.dmp
                                                        Download

                                                        memory/5600-73-0x00000000008C0000-0x0000000000920000-memory.dmp
                                                        Download

                                                        memory/5600-66-0x0000000140000000-0x0000000140226000-memory.dmp
                                                        Download

                                                        memory/5600-67-0x00000000008C0000-0x0000000000920000-memory.dmp
                                                        Download

                                                        memory/6336-940-0x000001E80EA70000-0x000001E80ECFB000-memory.dmp
                                                        Download