Overview

overview

10

Static

static

10

2026-11-01...op.exe

windows10-2004-x64

9

2026-11-01...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 08:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_ce769dbe49d31ea62af27a55a3fa76f3_darkgate_elex_glassworm_remcos_stop.exe
  • Size 6.7MB
  • Sample261102-j8tk9a1zev
  • SHA256 f71ff0f090f0f635687c115d03b34345d98e367aaab5c96a45e12779b74bd371
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoverypersistencespywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Uses Verclsid to proxy-execute a COM object 1 TTPs 1 IoCs

    Verclsid is a signed Windows utility that verifies COM shell extensions. It can instantiate specific CLSIDs to execute malicious payloads under a trusted binary.

    defense_evasion
  • Drops file in System32 directory 58 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_ce769dbe49d31ea62af27a55a3fa76f3_darkgate_elex_glassworm_remcos_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_ce769dbe49d31ea62af27a55a3fa76f3_darkgate_elex_glassworm_remcos_stop.exe"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1796
    • C:\Windows\system32\regsvr32.exe
      C:\Windows\Sysnative\regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
      2⤵
        PID:5480
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
          3⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Reads the TCP/IP host and domain name from the registry
          • Checks processor information in registry
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1684
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1972 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2088 -initialChannelId {b2595575-7f11-4ae9-995a-50a023ec9661} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
            4⤵
            • Executes dropped EXE
            PID:4296
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2480 -prefsLen 27133 -prefMapHandle 2484 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {81cf3220-c748-4dca-8c1a-93b5b0a0325a} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            4⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            PID:6096
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 25164 -prefMapHandle 3836 -prefMapSize 270279 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3848 -initialChannelId {096c0d78-93b7-4356-acb1-6c99b5632777} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:3192
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3996 -prefsLen 27274 -prefMapHandle 4000 -prefMapSize 270279 -ipcHandle 4132 -initialChannelId {34906c29-6e9d-4dc4-8cca-5dc3ad2ad8fa} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
            4⤵
            • Executes dropped EXE
            PID:4248
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2744 -prefsLen 34773 -prefMapHandle 3052 -prefMapSize 270279 -jsInitHandle 3056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2932 -initialChannelId {e7e99cd5-bb9c-45c7-997c-b293938ef311} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:2288
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5180 -prefsLen 35010 -prefMapHandle 5184 -prefMapSize 270279 -ipcHandle 5188 -initialChannelId {c5ce18a7-840d-4e02-a9ef-027186b73194} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6408
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 35062 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5512 -initialChannelId {79a94b44-0069-4c9f-89f6-740e38ff5450} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6568
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1684 -prefsLen 32952 -prefMapHandle 3284 -prefMapSize 270279 -jsInitHandle 3292 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {1785b121-2812-496a-96f5-fcd96a7191e2} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6776
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5884 -prefsLen 32952 -prefMapHandle 5888 -prefMapSize 270279 -jsInitHandle 5892 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5896 -initialChannelId {ab798b5d-b22d-4f7d-aa05-7511f5c40331} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6792
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6068 -prefsLen 32952 -prefMapHandle 6072 -prefMapSize 270279 -jsInitHandle 6076 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6084 -initialChannelId {f3311704-17d0-43dd-b677-97e88ecffe76} -parentPid 1684 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1684" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
            4⤵
            • Executes dropped EXE
            • Checks processor information in registry
            PID:6800
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMShellExt64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2780
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMIECC64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3860
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\IDMGetAll64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6264
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\downlWithIDM64.dll"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6552
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.internetdownloadmanager.com/welcome.html?v=643b16
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff2de9c188,0x7fff2de9c194,0x7fff2de9c1a0
          3⤵
            PID:1524
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,13790048878074546302,11116631960099369463,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:11
            3⤵
            • System Time Discovery
            PID:928
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,11234452398152403149,14531286646875720641,262144 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
            3⤵
              PID:6668
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,12200178244803947886,3105843979686438430,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
              3⤵
                PID:1304
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,2618887241325743952,1806309055368573072,2097152 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                3⤵
                  PID:5000
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,5104597375603726174,1605588239333638538,2097152 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                  3⤵
                    PID:2348
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,12028648619331479612,11328917306201713009,2097152 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
                    3⤵
                      PID:3012
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,5763465200798229388,5006011047390411288,2097152 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:9
                      3⤵
                        PID:4568
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,13034231339190546093,712453926393526676,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                        3⤵
                          PID:2900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8914493974569136512,1754317422606544617,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
                          3⤵
                            PID:3468
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,5906211336981325564,17288277265715119335,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
                            3⤵
                              PID:2084
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12965362176772774982,2617101010124588555,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                              3⤵
                                PID:1060
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12965362176772774982,2617101010124588555,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
                                3⤵
                                  PID:6168
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,11233319112510166104,13047290348697104020,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
                                  3⤵
                                    PID:6012
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8005625534676509565,10610122820223064471,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
                                    3⤵
                                      PID:5524
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,7265297849948205750,7947506426908703368,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
                                      3⤵
                                        PID:3456
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,7541413105907281400,17584658732480531327,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
                                        3⤵
                                          PID:6560
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,800179749886740051,5764048240326816118,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
                                          3⤵
                                            PID:7052
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1591743153165987184,13233043083285636847,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
                                            3⤵
                                              PID:4816
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,1859565945029870,1336877276023941245,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
                                              3⤵
                                                PID:2972
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,7046497783995667789,1284497043997968255,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
                                                3⤵
                                                  PID:2580
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,2661838198759045589,1235914262700792774,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
                                                  3⤵
                                                    PID:6556
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,15528003506715583536,1259502465544603323,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=1156 /prefetch:14
                                                    3⤵
                                                      PID:3480
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,4386599273526555492,522713309706400477,524288 --field-trial-handle=2552,i,2873447726529083142,15787791775801876303,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
                                                      3⤵
                                                        PID:5944
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1796 -s 2312
                                                      2⤵
                                                      • Program crash
                                                      PID:2884
                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • Drops file in Windows directory
                                                    • Reads the TCP/IP host and domain name from the registry
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4848
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4552
                                                  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:6028
                                                  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Drops file in Program Files directory
                                                    • Drops file in Windows directory
                                                    PID:4148
                                                  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:5076
                                                  • C:\Windows\SysWow64\perfhost.exe
                                                    C:\Windows\SysWow64\perfhost.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2412
                                                  • C:\Windows\System32\ReFsDedupSvc.exe
                                                    C:\Windows\System32\ReFsDedupSvc.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Checks processor information in registry
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4768
                                                  • C:\Windows\System32\SensorDataService.exe
                                                    C:\Windows\System32\SensorDataService.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • Checks SCSI registry key(s)
                                                    PID:4180
                                                  • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                    C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    PID:4844
                                                  • C:\Windows\system32\AgentService.exe
                                                    C:\Windows\system32\AgentService.exe
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1000
                                                  • C:\Windows\system32\SearchIndexer.exe
                                                    C:\Windows\system32\SearchIndexer.exe /Embedding
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Enumerates connected drives
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2472
                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                      2⤵
                                                      • Modifies data under HKEY_USERS
                                                      PID:5652
                                                    • C:\Windows\System32\SearchProtocolHost.exe
                                                      "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
                                                      2⤵
                                                        PID:1656
                                                      • C:\Windows\System32\SearchFilterHost.exe
                                                        "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:2180
                                                      • C:\Windows\System32\SearchFilterHost.exe
                                                        "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:2476
                                                      • C:\Windows\System32\SearchProtocolHost.exe
                                                        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                        2⤵
                                                        • Modifies data under HKEY_USERS
                                                        PID:6308
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                      1⤵
                                                        PID:3276
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                        1⤵
                                                          PID:2284
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1796 -ip 1796
                                                          1⤵
                                                            PID:7120
                                                          • C:\Windows\system32\verclsid.exe
                                                            "C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
                                                            1⤵
                                                            • Uses Verclsid to proxy-execute a COM object
                                                            PID:4200

                                                          Network

                                                                MITRE ATT&CK Enterprise v16

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Browser Extensions

                                                                1
                                                                T1176

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Modify Registry

                                                                3
                                                                T1112

                                                                System Binary Proxy Execution

                                                                1
                                                                T1218

                                                                Verclsid

                                                                1
                                                                T1218.012

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Browser Information Discovery

                                                                1
                                                                T1217

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Query Registry

                                                                5
                                                                T1012

                                                                System Information Discovery

                                                                6
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                System Network Configuration Discovery

                                                                1
                                                                T1016

                                                                System Time Discovery

                                                                1
                                                                T1124

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                elevation_service.exe
                                                                • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                • Size 2.7MB
                                                                • SHA256 8d46345f2a2d5d320e5168d975bd3c8883fe2d65dcdfb9068a736a77751769c6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                maintenanceservice.exe
                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                • Size 826KB
                                                                • SHA256 492afbc22db8dd2b39c30dd4795b7f0679df0b37cc29f686c8d5f4a33fb67e72
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7z.exe
                                                                • Path C:\Program Files\7-Zip\7z.exe
                                                                • Size 1.1MB
                                                                • SHA256 74fb5463a220575f3bd97f0f438f07be5a9326c0bcf3d51ac74eba81674127dc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7zFM.exe
                                                                • Path C:\Program Files\7-Zip\7zFM.exe
                                                                • Size 1.5MB
                                                                • SHA256 d7f05f5020ec4de164c6c8d0be55a4713c54c58612c266514a19e5859c300f37
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                7zG.exe
                                                                • Path C:\Program Files\7-Zip\7zG.exe
                                                                • Size 1.2MB
                                                                • SHA256 5721eccf3e615fd2fff788a783a466accd0b608b5761d2456e1d76ba40a5ddc9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Uninstall.exe
                                                                • Path C:\Program Files\7-Zip\Uninstall.exe
                                                                • Size 582KB
                                                                • SHA256 5b187589b8e3f2c64f59e23c960548796fe2596d7f48cac33c4bff43ed445c83
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AppVShNotify.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
                                                                • Size 840KB
                                                                • SHA256 b7f8d62bd6d079bdfc42be7e49ad519c6c04994bbe21c02f7b4d8352424e1f6b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                IntegratedOffice.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
                                                                • Size 4.6MB
                                                                • SHA256 688f927bcf70bddb496251c44edd77812867fbb6c08afd933b8aaccbe6573741
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MavInject32.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
                                                                • Size 910KB
                                                                • SHA256 eda685017f496885743c64c6aedef8d065902fcd6a2bb7c4a128a47334e45edc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OfficeC2RClient.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
                                                                • Size 24.0MB
                                                                • SHA256 9389e2bd87aeb1ed1324a36757597a286cc882b5c93e80be6523e0c0be7c7340
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                appvcleaner.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
                                                                • Size 2.7MB
                                                                • SHA256 28c3f0912fcf8671e045b694d612d91c8b3dac1928ab240a27e92df286861007
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                LICLUA.EXE
                                                                • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
                                                                • Size 1.1MB
                                                                • SHA256 013c0021764779e5000ea1a3c3f9344d11626251b63ea6011edc7a37ce3de745
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OSE.EXE
                                                                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                • Size 805KB
                                                                • SHA256 b1a783b292523dfa9db9cb1265b051b544f5181c92005543a63d2d3f5922107c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                VSTOInstaller.exe
                                                                • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
                                                                • Size 656KB
                                                                • SHA256 76bafb5fd09da3ce7cf0968bdb4164c50c1240e50437e572bf31a8ee7c3c846f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                chrome_pwa_launcher.exe
                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
                                                                • Size 2.3MB
                                                                • SHA256 8e766cc905785b503049a3592a25bce3dd9f40147ecd59e6458c012fb06ae172
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                elevation_service.exe
                                                                • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                • Size 2.8MB
                                                                • SHA256 a84a6f2c0392d5e67466035b5a599bc0e14113c7dca5c5cb1f5a8df53dc63c37
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                firefox.exe
                                                                • Path C:\Program Files\Mozilla Firefox\firefox.exe
                                                                • Size 1.2MB
                                                                • SHA256 b0e73f2ee773a1befab8f7c918eb94bd27d7cb0b525b987d5becf39c6e3d4cb9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                MsSense.exe
                                                                • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
                                                                • Size 1.0MB
                                                                • SHA256 d85af7e49df7e140911a5f980ba8aeaff75711ba22f574a5abe0d847bf85b8b9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                NisSrv.exe
                                                                • Path C:\Program Files\Windows Defender\NisSrv.exe
                                                                • Size 3.5MB
                                                                • SHA256 d13d007ad38869d9ad963dcbfa7eccc6a6549544ccb85e13c4745165406fd3f1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                wmpnetwk.exe
                                                                • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                • Size 1.4MB
                                                                • SHA256 382414f67031b1b78468a4f427e9ab982ef4b43dec2e9de742fd732ac343d2b2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                dotnet.exe
                                                                • Path C:\Program Files\dotnet\dotnet.exe
                                                                • Size 700KB
                                                                • SHA256 e10038043f19430125a672d9a0f055ff2e04ad1f7961eb09e103d2d5e13f0e8d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Windows.db
                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                                                                • Size 1.1MB
                                                                • SHA256 be1f35bae27a712e63da9dae1a727643a6b20c89f6e245829b67d0cbfaaae0d9
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                Windows.db-wal
                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                                                                • Size 382KB
                                                                • SHA256 5d38be6f540b6fe8530a41842a3d859bbeaab607a7fa6fb6bd82b90dffcad159
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                4503e59f-7234-4caf-9543-8c9fa9465d2e.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4503e59f-7234-4caf-9543-8c9fa9465d2e.tmp
                                                                • Size 39KB
                                                                • SHA256 83816091495744993b4ac82f1dee756d8dc8d96e7fb81e3ec6ee6f2dbcd1e9c8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                5d765098-051c-4fd4-b558-ad6c05d41cf9.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d765098-051c-4fd4-b558-ad6c05d41cf9.tmp
                                                                • Size 35KB
                                                                • SHA256 301a13267411417df2b57e9b8ea4e10e209a9afecda411aa34908bc429efec5c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                77ed0123-de26-4208-b58a-0aebead09d53.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77ed0123-de26-4208-b58a-0aebead09d53.tmp
                                                                • Size 35KB
                                                                • SHA256 9072ebf37c1644f6f035ab181b47ae0f3a12080423fc541a1eecd893f8271fec
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                916e027c-10ca-4827-b052-e706426e5880.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\916e027c-10ca-4827-b052-e706426e5880.tmp
                                                                • Size 43KB
                                                                • SHA256 c20421e301f636fe316431c2ceeba5c56436953898e0bd93b00db1b07b616495
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                settings.dat
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                • Size 280B
                                                                • SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                05d886cd-4b7f-4cd6-80c6-058f4396929b.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05d886cd-4b7f-4cd6-80c6-058f4396929b.tmp
                                                                • Size 11KB
                                                                • SHA256 1a0b524ca43100354a12adbba596ae24284be7ac85edd3c18ed8e68b3b900de2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                4ca0191a-ade3-4ebd-bf0f-ec84ccac573c.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ca0191a-ade3-4ebd-bf0f-ec84ccac573c.tmp
                                                                • Size 12KB
                                                                • SHA256 dda60c0f559f016f7d6574551345a16ac17e1d84f99e0ed88716296fe2f3a493
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                temp-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                • Size 3KB
                                                                • SHA256 175cf9a02bb8b981cd1c37e85d38565ff795b5b8d22f09e8f7b1ecc75f53ddce
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                the-real-index
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                • Size 3KB
                                                                • SHA256 065566e00780eb4dc398f643bcbda80564cc3410e2c20db127f5a73ab35fd36f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                b07c21ad-7a22-4221-aedb-2cca8140acbf.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b07c21ad-7a22-4221-aedb-2cca8140acbf.tmp
                                                                • Size 2B
                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                dasherSettingSchema.json
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                                • Size 854B
                                                                • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                40342b8c-0981-41a2-b8ef-a761be1eef49.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\40342b8c-0981-41a2-b8ef-a761be1eef49.tmp
                                                                • Size 40B
                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                f645a1b2-93f7-4e92-b322-5f0f2e4a4850.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f645a1b2-93f7-4e92-b322-5f0f2e4a4850.tmp
                                                                • Size 2KB
                                                                • SHA256 adf5b36a943fe4b963409d15f5f93825a015ae086121ca50fb6737d43c5c5a5b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                feb5104f-a653-4cc6-ad10-4e67d7953d69.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\feb5104f-a653-4cc6-ad10-4e67d7953d69.tmp
                                                                • Size 2B
                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                ab7b2a8d-174d-43f8-b4d5-d1080a07dde9.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab7b2a8d-174d-43f8-b4d5-d1080a07dde9.tmp
                                                                • Size 70KB
                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                f4560164-36d0-46cb-a770-9554e5941745.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4560164-36d0-46cb-a770-9554e5941745.tmp
                                                                • Size 12KB
                                                                • SHA256 e48753ae9052cd6266e217c551b33cda86809b9015321787754d23c8620d7eef
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ff06d1e0-67b8-4164-a33f-0252b98952c4.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff06d1e0-67b8-4164-a33f-0252b98952c4.tmp
                                                                • Size 29KB
                                                                • SHA256 00b0c53e23316dc87152a71537dad66f4ad7c16d620fff78c0ce9067f8335d33
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                375be818-a0cc-4698-968d-14cb58c2d307.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\375be818-a0cc-4698-968d-14cb58c2d307.tmp
                                                                • Size 22KB
                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                OperationConfig
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                • Size 3KB
                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                ca243469-c2c2-4208-9360-e0539b786e37.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca243469-c2c2-4208-9360-e0539b786e37.tmp
                                                                • Size 39KB
                                                                • SHA256 968f27d19cab8aea1148ce1479addb93de5b6abe1ad0b49ef8bc4263adf2096b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                5ce996e9-b6b1-4cc5-821b-b0534d3849e3.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5ce996e9-b6b1-4cc5-821b-b0534d3849e3.tmp
                                                                • Size 252B
                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                994eb863-05a9-4042-894c-5ad90a1384f5.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\994eb863-05a9-4042-894c-5ad90a1384f5.tmp
                                                                • Size 132B
                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                1f786429-9175-456f-a367-291ba3de7ff6.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1f786429-9175-456f-a367-291ba3de7ff6.tmp
                                                                • Size 13B
                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                • Size 158KB
                                                                • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                86e2dbf6-c165-4a54-a098-ccdc48c793de.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\86e2dbf6-c165-4a54-a098-ccdc48c793de.tmp
                                                                • Size 132B
                                                                • SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                activity-stream.contile.json
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.contile.json
                                                                • Size 4KB
                                                                • SHA256 ab5d54a1d9448f3f4b908d1f289da924c425ba9db0dd7a88db90e47efa90a306
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                activity-stream.discovery_stream.json
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\activity-stream.discovery_stream.json
                                                                • Size 75KB
                                                                • SHA256 367cb294bfded8a4e820e2211d000e307cbb538efaee891dcf583b9c5396ba93
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\cache2\entries\06A6D86B39A0E3DCE68006525D21C3AAB6C8E0B4
                                                                • Size 16KB
                                                                • SHA256 148754a97020213e72b17e58bd970c90ff4792f75cd0b05aa56a02e6e2afdefc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                webext.sc.lz4
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\startupCache\webext.sc.lz4
                                                                • Size 104KB
                                                                • SHA256 b096a28409f9771c05e998a380d094f6a6e1bacac1b7ff0076556db79da46b89
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                webext.sc.lz4
                                                                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\startupCache\webext.sc.lz4
                                                                • Size 105KB
                                                                • SHA256 f709f20dbd291eff84305f9440da697c75e5a01b4595a61d02a2eaade316a834
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                1ebcbf77-7a70-4482-8d03-5bc878f842c1.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\1ebcbf77-7a70-4482-8d03-5bc878f842c1.tmp
                                                                • Size 1B
                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                d9fed01c-7f1b-443d-842d-8cde219a1297.tmp
                                                                • Path C:\Users\Admin\AppData\Local\Temp\d9fed01c-7f1b-443d-842d-8cde219a1297.tmp
                                                                • Size 10KB
                                                                • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                content.js
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1076_43378942\CRX_INSTALL\content.js
                                                                • Size 9KB
                                                                • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                messages.json
                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1076_551854920\CRX_INSTALL\_locales\en_CA\messages.json
                                                                • Size 711B
                                                                • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 11KB
                                                                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 502KB
                                                                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                tmpaddon
                                                                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                • Size 21.9MB
                                                                • SHA256 1090c5d6881985c042370d506e15f1db1d0a88bfb7e9602a9202fac421098eb3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                addonStartup.json.lz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\addonStartup.json.lz4
                                                                • Size 4KB
                                                                • SHA256 aaef88ac41f93326795c57ea0fdbbc22a7a3d94706cb74f2de122d2d68d036e6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                broadcast-listeners.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\broadcast-listeners.json
                                                                • Size 221B
                                                                • SHA256 ae3d0fb9668da8e654bb58f562a11c8f29e4aec0a452c8831224f53c06a7b4f0
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                compatibility.ini
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\compatibility.ini
                                                                • Size 198B
                                                                • SHA256 252b7fff962848c61092e82a3d87adca163849767713a93ab533bb397f1f53bb
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                store.json.mozlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\crashes\store.json.mozlz4
                                                                • Size 66B
                                                                • SHA256 078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 36KB
                                                                • SHA256 36aae4ab62025b8111611a6ee536f40447ad5ff1c654acc9cfdced3a4eb12e30
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 36KB
                                                                • SHA256 541c8a37cf3a07808e2701d131bc977ec3626d9ef161cd620a43613019fca2c6
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 7KB
                                                                • SHA256 3df3c78fbf20d964c39cf1b3b28c461c6c42eaf57de71512a59921655cf2677b
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 7KB
                                                                • SHA256 7dd8305749e2565f22624bac4eafdca634c66a82455cf648dfb8787c33c1093c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                data.safe.tmp
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\db\data.safe.tmp
                                                                • Size 36KB
                                                                • SHA256 f1bb95e10ba02ba8bd20e11bb167657bc95cb79a2f61c74f446ed54ae1dfd0cc
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                events
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\events\events
                                                                • Size 1KB
                                                                • SHA256 9a724a8c2b127026011062b21a37da41cc9938fb602f28d497d44b11ae8889b1
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                events
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\events\events
                                                                • Size 2KB
                                                                • SHA256 0730281c330f0818ba200d7dcd5872d0661020698eddb1eadf9b2230ad0776c8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                28640e01-28cd-4cd6-86c6-5a3b0dce61a9
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\28640e01-28cd-4cd6-86c6-5a3b0dce61a9
                                                                • Size 16KB
                                                                • SHA256 a7673977fae9bfa1088ddcc3b7a756305ea6540fcaceb9fa6faa02a4672969d5
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                629902ad-151c-42cc-beaf-be6d06147ee3
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\629902ad-151c-42cc-beaf-be6d06147ee3
                                                                • Size 883B
                                                                • SHA256 a9f057fee16b783c82f9426da9134faf6c1d6e4f1fedabca4589d1bb49b5e2a8
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                8a9b8fde-eaa0-4ca7-b2b3-e76f9e29f9e3
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\8a9b8fde-eaa0-4ca7-b2b3-e76f9e29f9e3
                                                                • Size 2KB
                                                                • SHA256 2ff5c1d92e22b0bac3c975719fe312fac314c31088645d818c6aa68e51e0ace7
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                c4941972-2686-4d7a-a5fb-4153d2b59110
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\c4941972-2686-4d7a-a5fb-4153d2b59110
                                                                • Size 235B
                                                                • SHA256 15ebbdf2f08370e764fa382708fccd4f495279798a763a145ae199a145b5827b
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                e65ef8db-867a-4f2d-9887-e4c1573381d9
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\e65ef8db-867a-4f2d-9887-e4c1573381d9
                                                                • Size 886B
                                                                • SHA256 2445523e2ca9e27718d840abd8856a79942f0f251d9465f32fb074d078a8f153
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                ec59a534-1ba7-4e4f-ad72-456e1b5841bf
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\datareporting\glean\pending_pings\ec59a534-1ba7-4e4f-ad72-456e1b5841bf
                                                                • Size 235B
                                                                • SHA256 8fea6dbec2cb22a788606e982aeb28fa8d86b11334d8a7a3140699105fdeb84c
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                extension-preferences.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\extension-preferences.json
                                                                • Size 942B
                                                                • SHA256 aecfc11c0db969b2c79da2144415a8859c77d66fbfc37ca4924ac58a0ff29834
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                extensions.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\extensions.json
                                                                • Size 14KB
                                                                • SHA256 608115f77250171254420630f5a3ec02f1de543cf90ae13be8712a4cc9198cbd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                • Size 1.1MB
                                                                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                gmpopenh264.info
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                • Size 116B
                                                                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                LICENSE
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3112.0\LICENSE
                                                                • Size 473B
                                                                • SHA256 20de375707692099b3132084695377ce5fec0aec05813dedcce094b8eda44386
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3112.0\manifest.json
                                                                • Size 1005B
                                                                • SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                widevinecdm.dll
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll
                                                                • Size 21.9MB
                                                                • SHA256 7b44e84403fbb3faee15ca2d56eb8432fdf4eb68812c4460abdd20972528e825
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                widevinecdm.dll.sig
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\gmp-widevinecdm\4.10.3112.0\widevinecdm.dll.sig
                                                                • Size 1KB
                                                                • SHA256 f9f160cb5ca37ef81a3aa80eeb7fef8b302e18c82d92c34f42503e0ab085ada5
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                prefs-1.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs-1.js
                                                                • Size 6KB
                                                                • SHA256 fc453fc757765bb5ee61fc00e76a69f0abde402eba4dd9d046b4318b7288d3ba
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
                                                                • Size 12KB
                                                                • SHA256 f679a0dd28ed29602541ac58c269eb755390ef50e4b6257b19403c8ee1f6e1a2
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 310d5ef859515f5eab3882a809eff69c3875848b67f17e90f5a53e59b62c83d3
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
                                                                • Size 6KB
                                                                • SHA256 4dc6dabd8034c296cc345e189184a268c3ea487835cca2da5098ed73190230b1
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                prefs.js
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\prefs.js
                                                                • Size 7KB
                                                                • SHA256 7d9fc54bc00c1047c3b02a2f77a4f8b3ac03ce492155088bcd3d073e0bffce4f
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                sessionCheckpoints.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionCheckpoints.json
                                                                • Size 53B
                                                                • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                sessionCheckpoints.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionCheckpoints.json
                                                                • Size 90B
                                                                • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                recovery.jsonlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionstore-backups\recovery.jsonlz4
                                                                • Size 4KB
                                                                • SHA256 4211fef29655f28b96ac97ec3b1a9460cabebb6da543f30c0ac9610f5d47b5b4
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                recovery.jsonlz4
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\sessionstore-backups\recovery.jsonlz4
                                                                • Size 4KB
                                                                • SHA256 8fe95103bfedc8867c883d2cab1f363ab379e189dc8949dfb35b1e0142317719
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.6MB
                                                                • SHA256 db226c163ed1b8aac6d99e4a4731ee4c12acbe869df9c09d2f8c12dac7e83c35
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.7MB
                                                                • SHA256 33fcb9c81afc72a9e3090cd7ce7278f30af49f3b15151e11a655346f9f476c4d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.7MB
                                                                • SHA256 affa29e67b6a0374d9a304fc48c72e2924ff729b075f6055126be32298c44b0a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.7MB
                                                                • SHA256 390ebb9168634d220c5655fb28400c89754a05b36cb54db5451514c83b494ed7
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.7MB
                                                                • SHA256 d90afd0d50d4ef9253443823a71d1781b1b6bfba196b79bae9274cbf6c85648a
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.7MB
                                                                • SHA256 4dd4bf683a7e5de34cdcb4f6d763401947907f07512c574cd06b79c1854c82d8
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 7.7MB
                                                                • SHA256 59a389e8ce20c8d7063e1b16331a29c03eda002dd4111ea4f376ed139a871223
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 5.5MB
                                                                • SHA256 1f0e7fea4e57440c156e79a380a2cad88a933f575b1269c23169e91115b53403
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 5.5MB
                                                                • SHA256 424b0c9fefd21d87c8ec7a77cb3683e406dc1e684e7bf67d82fdea0945db214e
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                3870112724rsegmnoittet-es.sqlite
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                • Size 6.6MB
                                                                • SHA256 6f6b35e8a41ec5c931606525075738768ea3ed47ca5906cffa5f6083cc9c8932
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                targeting.snapshot.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\targeting.snapshot.json
                                                                • Size 3KB
                                                                • SHA256 b9a2b699a4b25ddd79e2264bcc67d98836f21dcaa1836cd8f4c61a97183df65f
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                xulstore.json
                                                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\v0mjt9aw.default-release\xulstore.json
                                                                • Size 167B
                                                                • SHA256 a261f6c4c1f49fbaac01d6d7437da1149f9b03588d54b2fd860fdfe969596115
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                perfhost.exe
                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                • Size 588KB
                                                                • SHA256 f7ef5ea40534d406aa9b93841cea624885be34b727c30135b17dc969279b9bcd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                AgentService.exe
                                                                • Path C:\Windows\System32\AgentService.exe
                                                                • Size 1.4MB
                                                                • SHA256 b93659d00fa614bad0d562c22896daf6b968920a234296d795fbd4158c9791c0
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ssh-agent.exe
                                                                • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                                                • Size 1.1MB
                                                                • SHA256 af9f01636f162df969bc48c5cf2099ac2a230e02aec478d346b51e6be4d3e2ab
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                ReFsDedupSvc.exe
                                                                • Path C:\Windows\System32\ReFsDedupSvc.exe
                                                                • Size 2.6MB
                                                                • SHA256 e27067a9b2d55bc51639ed6c7e24624a7be385b92125d32af72565e142dd056c
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SearchIndexer.exe
                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                • Size 1.4MB
                                                                • SHA256 4c334f62fe821f45983212ab7752fa279cfabeac55bbabaede511509c57b19ee
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SensorDataService.exe
                                                                • Path C:\Windows\System32\SensorDataService.exe
                                                                • Size 1.7MB
                                                                • SHA256 6a93b77260cf2bc138044b7f227bb2672b56f571f9a9cb259546de47557d4324
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1076_1365131584\manifest.json
                                                                • Size 135B
                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1076_1688918359\manifest.json
                                                                • Size 43B
                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                • MD5 SHA1 SHA512
                                                                Submit Download

                                                                manifest.json
                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1076_1924146173\manifest.json
                                                                • Size 160B
                                                                • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                • MD5 SHA1 SHA512 TLSH
                                                                Submit Download

                                                                AppVClient.exe
                                                                • Path C:\Windows\system32\AppVClient.exe
                                                                • Size 1.3MB
                                                                • SHA256 2c06b8cd6ae5659b410d5df14228822ffabe27858de7e37f5e4663cee116ccbd
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                PerceptionSimulationService.exe
                                                                • Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                                                • Size 804KB
                                                                • SHA256 bd83c82fbef2ba588a9b026804f70435a50b9b8462cf809e4e578eda51c95c6d
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                SgrmBroker.exe
                                                                • Path C:\Windows\system32\Sgrm\SgrmBroker.exe
                                                                • Size 964KB
                                                                • SHA256 f77f0345a54e64ec11e543afd7d44caae77eecd0b3ddee12bafdf9a8ab387567
                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                Submit Download

                                                                memory/1000-123-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                Download

                                                                memory/1000-124-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                                Download

                                                                memory/1000-136-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                                Download

                                                                memory/1000-138-0x0000000140000000-0x0000000140168000-memory.dmp
                                                                Download

                                                                memory/1000-130-0x0000000000BF0000-0x0000000000C50000-memory.dmp
                                                                Download

                                                                memory/1796-0-0x0000000000400000-0x0000000000AC9000-memory.dmp
                                                                Download

                                                                memory/1796-1580-0x0000000000400000-0x0000000000AC9000-memory.dmp
                                                                Download

                                                                memory/1796-1-0x0000000002DB0000-0x0000000002E16000-memory.dmp
                                                                Download

                                                                memory/1796-85-0x0000000000400000-0x0000000000AC9000-memory.dmp
                                                                Download

                                                                memory/1796-6-0x0000000002DB0000-0x0000000002E16000-memory.dmp
                                                                Download

                                                                memory/2412-307-0x0000000000400000-0x0000000000497000-memory.dmp
                                                                Download

                                                                memory/2412-75-0x0000000000400000-0x0000000000497000-memory.dmp
                                                                Download

                                                                memory/2412-76-0x00000000007D0000-0x0000000000836000-memory.dmp
                                                                Download

                                                                memory/2412-81-0x00000000007D0000-0x0000000000836000-memory.dmp
                                                                Download

                                                                memory/2472-142-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                Download

                                                                memory/2472-141-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                Download

                                                                memory/2472-673-0x0000000140000000-0x0000000140172000-memory.dmp
                                                                Download

                                                                memory/2472-148-0x00000000006A0000-0x0000000000700000-memory.dmp
                                                                Download

                                                                memory/2476-793-0x000001E33D080000-0x000001E33D30B000-memory.dmp
                                                                Download

                                                                memory/4148-61-0x0000000140000000-0x00000001400CF000-memory.dmp
                                                                Download

                                                                memory/4148-58-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                Download

                                                                memory/4148-52-0x00000000007B0000-0x0000000000810000-memory.dmp
                                                                Download

                                                                memory/4148-291-0x0000000140000000-0x00000001400CF000-memory.dmp
                                                                Download

                                                                memory/4180-99-0x0000000000810000-0x0000000000870000-memory.dmp
                                                                Download

                                                                memory/4180-98-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                Download

                                                                memory/4180-105-0x0000000000810000-0x0000000000870000-memory.dmp
                                                                Download

                                                                memory/4180-648-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                Download

                                                                memory/4180-641-0x0000000000810000-0x0000000000870000-memory.dmp
                                                                Download

                                                                memory/4180-336-0x0000000140000000-0x00000001401BA000-memory.dmp
                                                                Download

                                                                memory/4552-1181-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                                Download

                                                                memory/4552-1183-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/4552-26-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                                Download

                                                                memory/4552-140-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/4552-32-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                                Download

                                                                memory/4552-25-0x0000000140000000-0x00000001402D4000-memory.dmp
                                                                Download

                                                                memory/4552-33-0x00000000007E0000-0x0000000000840000-memory.dmp
                                                                Download

                                                                memory/4768-324-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                Download

                                                                memory/4768-86-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                Download

                                                                memory/4768-87-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                Download

                                                                memory/4768-93-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                Download

                                                                memory/4768-803-0x0000000000560000-0x00000000005C0000-memory.dmp
                                                                Download

                                                                memory/4768-805-0x0000000140000000-0x00000001402C9000-memory.dmp
                                                                Download

                                                                memory/4844-111-0x0000000140000000-0x000000014013E000-memory.dmp
                                                                Download

                                                                memory/4844-345-0x0000000140000000-0x000000014013E000-memory.dmp
                                                                Download

                                                                memory/4844-113-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                                Download

                                                                memory/4844-119-0x0000000000C60000-0x0000000000CC0000-memory.dmp
                                                                Download

                                                                memory/4848-110-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/4848-13-0x0000000000980000-0x00000000009E0000-memory.dmp
                                                                Download

                                                                memory/4848-21-0x0000000000980000-0x00000000009E0000-memory.dmp
                                                                Download

                                                                memory/4848-12-0x0000000140000000-0x00000001402E9000-memory.dmp
                                                                Download

                                                                memory/5076-71-0x00000000007A0000-0x0000000000800000-memory.dmp
                                                                Download

                                                                memory/5076-306-0x0000000140000000-0x00000001400CB000-memory.dmp
                                                                Download

                                                                memory/5076-63-0x0000000140000000-0x00000001400CB000-memory.dmp
                                                                Download

                                                                memory/5076-65-0x00000000007A0000-0x0000000000800000-memory.dmp
                                                                Download

                                                                memory/6028-38-0x00000000023B0000-0x0000000002410000-memory.dmp
                                                                Download

                                                                memory/6028-48-0x00000000023B0000-0x0000000002410000-memory.dmp
                                                                Download

                                                                memory/6028-37-0x0000000140000000-0x00000001400D5000-memory.dmp
                                                                Download

                                                                memory/6028-44-0x00000000023B0000-0x0000000002410000-memory.dmp
                                                                Download

                                                                memory/6028-50-0x0000000140000000-0x00000001400D5000-memory.dmp
                                                                Download