Overview

overview

10

Static

static

10

2026-11-01...op.exe

windows10-2004-x64

9

2026-11-01...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 08:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_ce769dbe49d31ea62af27a55a3fa76f3_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.7MB
  • Sample261102-j8tk9a1zev
  • SHA256 f71ff0f090f0f635687c115d03b34345d98e367aaab5c96a45e12779b74bd371
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ce769dbe49d31ea62af27a55a3fa76f3_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_ce769dbe49d31ea62af27a55a3fa76f3_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4556
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Reads the TCP/IP host and domain name from the registry
        • Checks processor information in registry
        • Modifies Control Panel
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3892
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2076 -prefsLen 27099 -prefMapHandle 2080 -prefMapSize 270279 -ipcHandle 2164 -initialChannelId {ed384156-368f-4743-a28d-096fc9dc4f1f} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          4⤵
          • Executes dropped EXE
          PID:3500
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2552 -prefsLen 27135 -prefMapHandle 2556 -prefMapSize 270279 -ipcHandle 2572 -initialChannelId {4b9ef675-9adf-4b3d-806c-a5d9c430c178} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          PID:2188
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3896 -prefsLen 25164 -prefMapHandle 3900 -prefMapSize 270279 -jsInitHandle 3904 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3912 -initialChannelId {cff96196-faff-4d7b-a6ad-51c85df1bd6f} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:4896
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4060 -prefsLen 27276 -prefMapHandle 4064 -prefMapSize 270279 -ipcHandle 4152 -initialChannelId {b79b2828-8f10-4f0c-a3bb-5f5aa119c868} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
          4⤵
          • Executes dropped EXE
          PID:2500
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3136 -prefsLen 34775 -prefMapHandle 2728 -prefMapSize 270279 -jsInitHandle 2732 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3140 -initialChannelId {01ece23c-3d32-41b2-9ce0-91bf1cab5f1d} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:4988
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4576 -prefsLen 35012 -prefMapHandle 4580 -prefMapSize 270279 -ipcHandle 4820 -initialChannelId {56dee6d1-a21e-4d1c-a2ac-146cf0e6d663} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5648
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5108 -prefsLen 32952 -prefMapHandle 5112 -prefMapSize 270279 -jsInitHandle 5116 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5124 -initialChannelId {73260dda-1e68-4bf5-ad93-7ed5f1829e02} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5668
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140 -prefsLen 32952 -prefMapHandle 5144 -prefMapSize 270279 -jsInitHandle 5148 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5156 -initialChannelId {e5f101e6-f7bd-47ef-9a9b-0812db272914} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5680
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5512 -prefsLen 32952 -prefMapHandle 5516 -prefMapSize 270279 -jsInitHandle 5520 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5528 -initialChannelId {8e413ade-01ca-4ed9-959f-204f404fa155} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5704
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5536 -prefsLen 32952 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5552 -initialChannelId {4f12b3e8-b0d7-4a97-8d6d-90cc1d1d8c25} -parentPid 3892 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3892" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:5720
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4020
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4256
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5244
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5288
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4832
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1784
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3200
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3104
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:540
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4168
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:2540
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4220
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4116
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3792
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3316
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:216
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4024
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:4268
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4128
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:4416
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:3472
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:764
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5060
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:4728
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2112
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5036
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        PID:3368
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Direct Volume Access: Opens a physical disk for reading
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4212
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:1812
      • C:\Windows\System32\WaaSMedicAgent.exe
        C:\Windows\System32\WaaSMedicAgent.exe 196b055ecbd393624ff114a0b698264b w8JRrywOwEKBm7y47Prw7w.0.1.0.0.0
        1⤵
          PID:4556

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Browser Extensions

              1
              T1176

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Defense Evasion

              Direct Volume Access

              1
              T1006

              Modify Registry

              3
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              4
              T1012

              System Information Discovery

              5
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 bfd863205147e94fd2710e2bb7e0179b206638870297ced82e9857be731ee5bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 826KB
              • SHA256 182125401d9ec5ae5bfcf064927759b7bd872c9dabd0fc291af76225a05ef9a0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.1MB
              • SHA256 ff56f464f71177ba82bd6debaa357f3bb8b89d62ff2e5edcea7ae02018f94d92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 7278619aa989ff30afe66d18b68594a852db74890e87ba60f991052c52d67274
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 83a22ff12e96743c7f99b43bc4e2f610d4486a71f3758c3f3c41fe046203fb84
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 582KB
              • SHA256 073d379715bfc066cfab4fe726e64514c0e7085f9de7c8e2a305fe902a0d0c51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 840KB
              • SHA256 0cf4bcdb81c27d656e2873989371570e87ecf24b3d1c47cb7273806b069ba555
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 8d1be4e841e6ffb9a806df601925e6bd4ba132b29c4ff4098bd7cfb9010a3b4c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 910KB
              • SHA256 5a5ad947cda821aa0a7754fec02362e564e14f0732bd20d53d2d35fcef99949e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 9ea6fa7df59ecfb6237d67094dc546965ebe5ace4ab1c0d8054e8ec2e28cbc86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 89bd17c85b784cb2bcfe2f5085d5b248b357b1607c4d8cd0b2b0c4549bb05eb6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 9a13c6133d7a99fafd743369d056a0e9bff3eb9f6b5f757b2cb6eb01d30ef643
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 805KB
              • SHA256 7814ea98a610e1069f4ec998d83b69193a59790cec8f698a0aaa9b4e7f7c5bff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 656KB
              • SHA256 bd36882895026c66d0c788bebe2d25ea203ec5c9e84439a9357f2b1fab45bc0c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
              • Size 6.6MB
              • SHA256 c5a1373573f9a8eff3cde9b29e82dabc3ef4863e2a2639e61d2a59fb3772c9b5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
              • Size 6.6MB
              • SHA256 5a333570cfb8656eef3385bbd325981eea0786e002235715a33fb6b17dc89e9c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
              • Size 2.3MB
              • SHA256 9bf42a80c7edbc83abb469f0a55495842d01adfeb7bf050472b6242e2fb24202
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevated_tracing_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
              • Size 4.0MB
              • SHA256 21cb744b401fa5f4aeeb62ab66d75dcc7b90d911fe5e4dffa2d082ec0459f3a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 efb6869c64a11a3ba62f10addc1d16c4b2e0ed515356ac7111d82b991edcd5a5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
              • Size 2.2MB
              • SHA256 49890dadff080486e3731808a55a374a5859f724386466e2a86dfe524364d1e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              os_update_handler.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
              • Size 2.4MB
              • SHA256 108859f354e22a537a1dea1cf17e85d72db31a5961844dc9e9f140a051e5ee27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 2.0MB
              • SHA256 9b54cb35f1c6c1c5585ff3106a8c8e45bf24c59c43276fd2a0f4b59333f9ec04
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 581KB
              • SHA256 ab3f4cb095d0e4c7b95d229e81435bd23c55da1426b00b8735caccb596dc2de9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              firefox.exe
              • Path C:\Program Files\Mozilla Firefox\firefox.exe
              • Size 1.2MB
              • SHA256 36fe74e611d336c7b08fcee8663838ad6b5e80523a4ff983696a0ad967c8dea2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 a18744aba81806aa0a0ec796a1ade2cd495b04aa818e29d7f9253229193ec2ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 700KB
              • SHA256 e96f517fd33cdf6fa213f4b6ceb83d5b8245e111a205f3b8cba7386c85650de7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              activity-stream.contile.json
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\activity-stream.contile.json
              • Size 4KB
              • SHA256 ab5d54a1d9448f3f4b908d1f289da924c425ba9db0dd7a88db90e47efa90a306
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              activity-stream.discovery_stream.json
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\activity-stream.discovery_stream.json
              • Size 75KB
              • SHA256 c7ec91df026ac4db41e300b97903fa9fbe8a3d338b3738c0a81d566662eab922
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              23965
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\doomed\23965
              • Size 135B
              • SHA256 3a06271d079bf3bd7d08cabed235e2e80d11878a318cce26bc4a303063a00209
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
              • Size 16KB
              • SHA256 087434e7b7941d7c6bdf0beb127dab9a096737b408d8d5ad618aa7673951a8b4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              webext.sc.lz4
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\startupCache\webext.sc.lz4
              • Size 104KB
              • SHA256 361eb7db0cb1dc19b1da8235f53caed227a25f25b2f4a1dfff37e9a0483e2e53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              webext.sc.lz4
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\startupCache\webext.sc.lz4
              • Size 105KB
              • SHA256 f9bbe9a3974ff5721f725b7decc57f57f0cb13833514e9207eb964d7d337ba0f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 11KB
              • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 502KB
              • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmpaddon
              • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
              • Size 21.9MB
              • SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              www_internetdownload
              • Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\www_internetdownload
              • Size 9KB
              • SHA256 5b462f6871410ba49ff47a42bc44d8451f93f60a1ece48381a912ac3519ef51d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              addonStartup.json.lz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\addonStartup.json.lz4
              • Size 4KB
              • SHA256 b03e9795ac97cd891bc88541883e3393fe8acd1df0c44929e6141729d5138f7c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              store.json.mozlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\crashes\store.json.mozlz4
              • Size 66B
              • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
              • Size 3KB
              • SHA256 7c01b49b2dc7afc9e022ed9bb4c2477a1d7a69ed74742a1f8acaaa8077c72cf5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
              • Size 5KB
              • SHA256 b32e3c41d921ac3c431ee33781470109ec81f1d18fd51bb3376ea437883eb8f0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
              • Size 6KB
              • SHA256 82278a54802365adfd9ab1740a83deba50158825b3bad85ce96ec8d262fbb6d2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\db\data.safe.tmp
              • Size 7KB
              • SHA256 4f83875cdf9877101d0d0dc61b47c98341d414f315dd081dbbef0600392bc20b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              events
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\events\events
              • Size 1KB
              • SHA256 ddd05820a6d4b29029d3271df4b7663080960af9ef20d42212c819326a74eb12
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              239bec4f-bfe9-4407-9a34-43288ea8da08
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\239bec4f-bfe9-4407-9a34-43288ea8da08
              • Size 235B
              • SHA256 3525c2806ad60af495842403dc192a7d412b9daba336fdafb7fdccee19f0dc50
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              2dcfd125-3858-4343-bb57-96ca06c96a49
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\2dcfd125-3858-4343-bb57-96ca06c96a49
              • Size 886B
              • SHA256 44405a279a2261788a69ae5f08a49a67373f9e2ec7d1994733dc066964ae1f85
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              7b02bcc3-daff-4dd5-9909-30a334712494
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\7b02bcc3-daff-4dd5-9909-30a334712494
              • Size 16KB
              • SHA256 9f3ce56d391e710b7a828b0c6cd465bec7e9ee7e6e14b77a7dae80ac50e60624
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              96809581-8f50-4b45-a512-353722cb4fbd
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\96809581-8f50-4b45-a512-353722cb4fbd
              • Size 2KB
              • SHA256 1e98c4ac0152dd3390473566dca1023e8e367e5662be405c0d401c0537ff88f2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              a837669c-866f-4d56-84cd-14ef1f97322e
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\a837669c-866f-4d56-84cd-14ef1f97322e
              • Size 883B
              • SHA256 125be0ccbc0d1c2b031f17ef3222c6bb3db04a6235e58466adb85eb0fad8eb79
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ddd862bf-e6a0-4028-beb7-a0f2e082ebb2
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\datareporting\glean\pending_pings\ddd862bf-e6a0-4028-beb7-a0f2e082ebb2
              • Size 235B
              • SHA256 52e9c930e6189bc37e339ecebbeb1f7ca6647897b8d758f91394b706955af077
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extension-preferences.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extension-preferences.json
              • Size 942B
              • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extensions.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\extensions.json
              • Size 14KB
              • SHA256 1bd3c9439f541730fff0ee4184f8f9a962578891df325cfd0b17e6df2181e32c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
              • Size 1.1MB
              • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gmpopenh264.info
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
              • Size 116B
              • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              LICENSE
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
              • Size 473B
              • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              manifest.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
              • Size 1005B
              • SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              widevinecdm.dll
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
              • Size 21.9MB
              • SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              widevinecdm.dll.sig
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
              • Size 1KB
              • SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
              • Size 8KB
              • SHA256 87175f8a2be01e4be898a2d967625a84405e11dbbfa7bee38e1c8c37656a1bca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs-1.js
              • Size 6KB
              • SHA256 f88c14bcd76365ab89e195e173b1872bd7a100a69feccbe7565c9202b1f14098
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
              • Size 6KB
              • SHA256 d4c083222d24bd479e12d40a840dceb1ed973d7b227b867d2ec17ec6db1dd6f9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
              • Size 6KB
              • SHA256 faf329be7d01054504e28b2d466abf0e30c563a6cad1ca9f2a3bddf7ce2276c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\prefs.js
              • Size 7KB
              • SHA256 5e23e0c90c4d8b6ddffa89e3e640f093c19a4966f5fa6f6988ef9199788c5aa9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sessionCheckpoints.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionCheckpoints.json
              • Size 53B
              • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sessionCheckpoints.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionCheckpoints.json
              • Size 90B
              • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              recovery.jsonlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 4KB
              • SHA256 7efb805586e5798407fecac9fd6c37f0933d538ceb3d8e3e027be020aa06a9a1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              recovery.jsonlz4
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\sessionstore-backups\recovery.jsonlz4
              • Size 4KB
              • SHA256 da79e46384562c4f74d4419df5de03a94bcf9bfcdd8efd03ffe505c5f0c78da3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 6.4MB
              • SHA256 e135bfd6ff28bea4ce92da85e0e24bf199be2a2709e4f2048cde6d8513f3a5e3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.5MB
              • SHA256 5f04e04fa6c1ca6fb3f8662232bc525e66cc6ec477243edf3dbdb46ecfc98b20
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 e56efa8f863df1b8acd1dce069d2bff347d46aa0780ef71137d0f98b3fbfdc55
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 7.6MB
              • SHA256 7047b354df39e930f322be9ea9b883a4e4ce5a09f3b07b9de66389a2da0402de
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 5.4MB
              • SHA256 6d2eaa99b2fd8ac9ab94287820dd8e8fd285e6d3e34cf73a44c5674c1057756d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              targeting.snapshot.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\targeting.snapshot.json
              • Size 3KB
              • SHA256 dc784a9a4a7318c979543b9a6b9bbc1028ed5988331f08148c6dc6004aa0b29f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              xulstore.json
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bg4lcjz5.default-release\xulstore.json
              • Size 167B
              • SHA256 c1bed5f53e44f988d50469fe36ee52ab0bfe2215cc126514ad06b5c0c28dfd87
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 588KB
              • SHA256 90bea844b4f34e9665f577cccf8ce349deeb4460641786450b1f5464592356e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 d3d42de1bdcfae0eeb034c01f022921218ba88bd58672cf0acb35e2a09425624
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 659KB
              • SHA256 508fd55bbf3ea23bbe84c8707d3f3312ac4db1dce9c2c45a72e91029485a704a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 85604e5e2dce8286ca8c17fa5c390b99a9e3a014dc021c5a3537962029127c91
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 578KB
              • SHA256 e8a1413cd66a6a874757624ee4d4d1cb71b39b3841380bdd867f84912764929c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 940KB
              • SHA256 ad0aec31ce4dfb7f1a440d72fc07b62a2540f49a245c42a7054d0dfe6486586a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 671KB
              • SHA256 9f52229ece4e5209950b671fdd19da9a60c91ec720e229c0091c567837d728fd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 7b049c8f825226086e97b25fce9e0ec6b891c7c0f686d0b4649675f713ce51dd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 71a7d4fffa262a1dd2eebbb4b00605200f18fe314499f43da8b71ebd1cac8037
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 badeff4b3cdea9bcbc5e71a0385e4b2c5cbb812e60770646bab11c5a27d66e2c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 885KB
              • SHA256 952a528bea184854ef5cff757279717e2a183f70b6eea2f762c25a21a302e285
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 c7d6b2495ea6ba5fd00b01775dd3c84fc0b61c62cc41ff6e42517b7b763badd9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 661KB
              • SHA256 17ba4e186a5efedc04dd5a8829e42cd666211212139df05472b134c20e85a496
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 712KB
              • SHA256 bfb3efff03f4368729097c4e3b9bccf4df7d83090eac1c0c06c3ce6d79322fe8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 584KB
              • SHA256 9ea6ca43bc67c9fdc2c6c7f8bfc75b9eceba558a72175dd2b2162fc69a5f64d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 8161111f8a45b651df504599245f934f32c0338ac4658662f587eac2a7c5d475
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 772KB
              • SHA256 160c8b6694b3c9d715813d6e0a90594139014f7ef4582e0018fb89acc6dd56ae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 5069ec27798b2954342637cb86bcc39e400cf454fa1ce09fb96214460820ca5b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 0273a69e2d6fc6ec1b60eac19eb1d3c9b92fdff995c070d647392376f99dcf51
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 877KB
              • SHA256 d7a63347bc73a17e77b90e8b382c7aaac6b76ad6440a0b48ff9d129be1757e8c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 635KB
              • SHA256 b541bca7434d820ccbfa1d6478c88fe7bd76a6a14a3daca26376eeb8ef4db43b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/216-111-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/216-165-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/540-38-0x0000000000510000-0x0000000000570000-memory.dmp
              Download

              memory/540-40-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/540-32-0x0000000000510000-0x0000000000570000-memory.dmp
              Download

              memory/540-128-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/1784-15-0x00000000006D0000-0x0000000000730000-memory.dmp
              Download

              memory/1784-24-0x00000000006D0000-0x0000000000730000-memory.dmp
              Download

              memory/1784-23-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/1812-858-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-847-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-857-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-854-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-855-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-856-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-853-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-852-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-851-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-841-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-765-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-842-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-775-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-774-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-773-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-772-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-764-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-782-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-783-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-786-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-789-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-788-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-787-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-785-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-784-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-781-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-780-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-835-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-836-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-838-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-840-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-839-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-837-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-844-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-848-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-850-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-849-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-843-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-846-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/1812-845-0x000002CB48FA0000-0x000002CB48FB0000-memory.dmp
              Download

              memory/2112-399-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/2112-157-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/2540-65-0x0000000001A60000-0x0000000001AC0000-memory.dmp
              Download

              memory/2540-63-0x0000000140000000-0x00000001400D5000-memory.dmp
              Download

              memory/2540-54-0x0000000001A60000-0x0000000001AC0000-memory.dmp
              Download

              memory/2540-67-0x0000000140000000-0x00000001400D5000-memory.dmp
              Download

              memory/2540-60-0x0000000001A60000-0x0000000001AC0000-memory.dmp
              Download

              memory/2908-5-0x00000000031B0000-0x0000000003216000-memory.dmp
              Download

              memory/2908-0-0x00000000031B0000-0x0000000003216000-memory.dmp
              Download

              memory/2908-7-0x0000000000400000-0x0000000000AC9000-memory.dmp
              Download

              memory/2908-71-0x0000000000400000-0x0000000000AC9000-memory.dmp
              Download

              memory/3104-28-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3104-30-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3316-161-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/3316-107-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/3316-98-0x0000000000770000-0x00000000007D6000-memory.dmp
              Download

              memory/3316-103-0x0000000000770000-0x00000000007D6000-memory.dmp
              Download

              memory/3368-721-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/3368-166-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/3472-146-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/3472-364-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/3792-91-0x0000000000B20000-0x0000000000B80000-memory.dmp
              Download

              memory/3792-85-0x0000000000B20000-0x0000000000B80000-memory.dmp
              Download

              memory/3792-94-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/3792-156-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/4024-113-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4024-169-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4024-395-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/4116-152-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/4116-80-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/4116-74-0x00000000007B0000-0x0000000000810000-memory.dmp
              Download

              memory/4116-83-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/4128-129-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4128-120-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/4128-126-0x00000000006C0000-0x0000000000720000-memory.dmp
              Download

              memory/4128-343-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4168-43-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/4168-142-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/4168-51-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/4168-49-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/4204-252-0x0000000009E60000-0x0000000009E68000-memory.dmp
              Download

              memory/4204-186-0x0000000001770000-0x0000000001780000-memory.dmp
              Download

              memory/4204-362-0x000000000CDE0000-0x000000000CDE8000-memory.dmp
              Download

              memory/4204-202-0x0000000001A20000-0x0000000001A30000-memory.dmp
              Download

              memory/4204-744-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/4204-170-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/4220-72-0x0000000140000000-0x00000001400B9000-memory.dmp
              Download

              memory/4268-118-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/4268-287-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/4416-139-0x0000000000C80000-0x0000000000CE0000-memory.dmp
              Download

              memory/4416-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp
              Download

              memory/4416-358-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/4416-143-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/4728-154-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/4728-394-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/4832-106-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/4832-11-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/5036-162-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/5036-643-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/5060-148-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/5060-150-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download