Overview

overview

8

Static

static

5

2026-11-03...ch.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 17:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_7074eff392813f552f4ced694189414c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  • Size 14.0MB
  • Sample261104-vt4cpaby2x
  • SHA256 6679452bac9fe219286ba6a0217aa568c94769653c321157c5c3c83f52c73df7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
credential_accessdefense_evasiondiscoverymacroransomwarespywarestealerupx

Malware Config

Signatures

  • Suspicious Office macro 3 IoCs

    Office document equipped with macros.

    macro
  • Uses browser remote debugging 2 TTPs 19 IoCs

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 19 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 33 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_7074eff392813f552f4ced694189414c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_7074eff392813f552f4ced694189414c_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --remote-debugging-port=0 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile --no-first-run --no-default-browser-check --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding
      2⤵
      • Uses browser remote debugging
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:636
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef296c728,0x7ffef296c734,0x7ffef296c740
        3⤵
          PID:5104
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
          3⤵
            PID:3536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
            3⤵
            • System Time Discovery
            PID:4556
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:8
            3⤵
              PID:4504
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
              3⤵
              • Uses browser remote debugging
              PID:3808
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
              3⤵
              • Uses browser remote debugging
              PID:4360
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
              3⤵
              • Uses browser remote debugging
              PID:928
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:2
              3⤵
              • Uses browser remote debugging
              PID:2908
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:2
              3⤵
              • Uses browser remote debugging
              PID:3984
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
              3⤵
              • Uses browser remote debugging
              PID:2352
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
              3⤵
              • Uses browser remote debugging
              PID:4784
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
              3⤵
                PID:1380
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
                3⤵
                  PID:5724
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:5816
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:5572
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
                  3⤵
                  • Uses browser remote debugging
                  PID:3404
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
                  3⤵
                    PID:3580
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
                    3⤵
                      PID:820
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      PID:3960
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
                      3⤵
                      • Uses browser remote debugging
                      PID:6072
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
                      3⤵
                        PID:6080
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
                        3⤵
                          PID:6100
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
                          3⤵
                          • Uses browser remote debugging
                          PID:6108
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
                          3⤵
                          • Uses browser remote debugging
                          PID:5500
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:8
                          3⤵
                            PID:5988
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
                            3⤵
                              PID:1348
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:5568
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
                              3⤵
                              • Uses browser remote debugging
                              PID:5188
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:2
                              3⤵
                              • Uses browser remote debugging
                              PID:5272
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-background-timer-throttling --remote-debugging-port=0 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:2
                              3⤵
                              • Uses browser remote debugging
                              PID:5784
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
                              3⤵
                                PID:6064
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
                                3⤵
                                  PID:6056
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
                                  3⤵
                                    PID:6052
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,2896356909448462333,16491765094135635169,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
                                    3⤵
                                      PID:5476
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Program Files directory
                                  • Drops file in Windows directory
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:3972
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:3440
                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:1516
                                • C:\Windows\System32\msdtc.exe
                                  C:\Windows\System32\msdtc.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Drops file in Windows directory
                                  PID:4884
                                • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                  "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2096
                                • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                  C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2564
                                • C:\Windows\SysWow64\perfhost.exe
                                  C:\Windows\SysWow64\perfhost.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4548
                                • C:\Windows\system32\locator.exe
                                  C:\Windows\system32\locator.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:4332
                                • C:\Windows\System32\SensorDataService.exe
                                  C:\Windows\System32\SensorDataService.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:2324
                                • C:\Windows\System32\snmptrap.exe
                                  C:\Windows\System32\snmptrap.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Reads the TCP/IP host and domain name from the registry
                                  PID:4140
                                • C:\Windows\system32\spectrum.exe
                                  C:\Windows\system32\spectrum.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:3620
                                • C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  C:\Windows\System32\OpenSSH\ssh-agent.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2948
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
                                  1⤵
                                    PID:5012
                                  • C:\Windows\system32\TieringEngineService.exe
                                    C:\Windows\system32\TieringEngineService.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Checks processor information in registry
                                    PID:1900
                                  • C:\Windows\system32\AgentService.exe
                                    C:\Windows\system32\AgentService.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1120
                                  • C:\Windows\System32\vds.exe
                                    C:\Windows\System32\vds.exe
                                    1⤵
                                    • Executes dropped EXE
                                    PID:1444
                                  • C:\Windows\system32\vssvc.exe
                                    C:\Windows\system32\vssvc.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:416
                                  • C:\Windows\system32\wbengine.exe
                                    "C:\Windows\system32\wbengine.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4700
                                  • C:\Windows\system32\wbem\WmiApSrv.exe
                                    C:\Windows\system32\wbem\WmiApSrv.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Reads the TCP/IP host and domain name from the registry
                                    PID:3296
                                  • C:\Windows\system32\SearchIndexer.exe
                                    C:\Windows\system32\SearchIndexer.exe /Embedding
                                    1⤵
                                    • Executes dropped EXE
                                    • Direct Volume Access: Opens a physical disk for reading
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:1696
                                    • C:\Windows\system32\SearchProtocolHost.exe
                                      "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:4672
                                    • C:\Windows\system32\SearchFilterHost.exe
                                      "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
                                      2⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1872
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:4112

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          elevation_service.exe
                                          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          • Size 2.7MB
                                          • SHA256 13f9f6d23dd95277ff87af7ab78c043a73fce55ff8e003ade8b62872bf02b9a8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Uninstall.exe
                                          • Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
                                          • Size 820KB
                                          • SHA256 fc168e64fd03604659a294e5358d83c19810cbc6fa8e5bd55ee0c873df69de5d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          maintenanceservice.exe
                                          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                          • Size 2.5MB
                                          • SHA256 d85910cb397f9acf5928bde679d6e889e262c0ae1dea25306372b98ca75876bb
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          maintenanceservice.exe
                                          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                          • Size 1.7MB
                                          • SHA256 df98eb203ea30e3271bb1c90b5c2d0078671da7423babb1a65e70ef972109cf3
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          OSE.EXE
                                          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                                          • Size 1.7MB
                                          • SHA256 68efbcafee3a58cec488465255ffea2d8682d85456530b51fdb2debfc46f41a6
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          elevation_service.exe
                                          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                          • Size 2.8MB
                                          • SHA256 248615ff2a14e38e7e4f211bc4a51e216149b323bbbccd9a529b733f2761315c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          wmpnetwk.exe
                                          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
                                          • Size 2.2MB
                                          • SHA256 bbca4d5d6f5d10c86c16124c5e07f345fb836868faede8e7cb0464d0e2546c5e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          4362e3cd-67ca-408a-93e2-e7de28989aee.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\4362e3cd-67ca-408a-93e2-e7de28989aee.tmp
                                          • Size 145KB
                                          • SHA256 a4b68d61e8d56433b704bb18e621617a45f99259ab37523295b2cca683f33aa8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          settings.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Crashpad\settings.dat
                                          • Size 40B
                                          • SHA256 89f3b2842b0e4b4c1cc378fb270a67dd04b8d05083ab32891deb3704f6fe4ab9
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          1851de7a-9384-4092-9a1d-4fb2d3b85879.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\1851de7a-9384-4092-9a1d-4fb2d3b85879.tmp
                                          • Size 9KB
                                          • SHA256 cfdc71bf8362bac86e8a127eeb84aa90784eff58043348b3ef35e84ed44168a4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          temp-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Code Cache\js\index-dir\temp-index
                                          • Size 72B
                                          • SHA256 03f5ddbb0638d3935a12c9ccf0fa66f166fe7208d58c06dba87ab6153ffa6919
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Code Cache\js\index-dir\the-real-index
                                          • Size 48B
                                          • SHA256 3704ad7743f3e40c5f97aba1f71f4e9770d33f2f237f234bff33d94bb511553f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          data_0
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\DawnGraphiteCache\data_0
                                          • Size 8KB
                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data_1
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\DawnGraphiteCache\data_1
                                          • Size 264KB
                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data_2
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\DawnGraphiteCache\data_2
                                          • Size 8KB
                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          data_3
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\DawnGraphiteCache\data_3
                                          • Size 8KB
                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          messages.json
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\_locales\en_CA\messages.json
                                          • Size 851B
                                          • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          dasherSettingSchema.json
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                          • Size 854B
                                          • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          service_worker_bin_prod.js
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\service_worker_bin_prod.js
                                          • Size 137KB
                                          • SHA256 63b3d006783e106d3aacb9cda3224d48a218dd45d50db663d38b45d2d9b2bff0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          messages.json
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                          • Size 593B
                                          • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          craw_background.js
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                          • Size 531KB
                                          • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          4cb8f6e7-7d73-44f9-beb5-a0c5897d98e1.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Network\4cb8f6e7-7d73-44f9-beb5-a0c5897d98e1.tmp
                                          • Size 2KB
                                          • SHA256 2b3e4fcda0878e29217b688842944a202a2c25cf328874db30799aca8b100999
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SCT Auditing Pending Reports
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Network\SCT Auditing Pending Reports
                                          • Size 2B
                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Preferences
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Preferences
                                          • Size 8KB
                                          • SHA256 deacda4ad8e648ef99b355d2bf960c78f092ddcac4270633dd7429dae3efb228
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Service Worker\ScriptCache\index
                                          • Size 24B
                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          temp-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Service Worker\ScriptCache\index-dir\temp-index
                                          • Size 120B
                                          • SHA256 679c6d0b71973762a95e9804c5fa5de38a2234b3a2dae602aae8795e1eef8386
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          the-real-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                          • Size 72B
                                          • SHA256 8e2da92cd584f03e01900327a7aedf3aba5440538a417563f4de29dd31a84a4e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          MANIFEST-000001
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Site Characteristics Database\MANIFEST-000001
                                          • Size 41B
                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          temp-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
                                          • Size 48B
                                          • SHA256 02d8a1e4165733cd7621e16ccda17a1e982e31c53fce129bd5d14a367619155f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          temp-index
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
                                          • Size 72B
                                          • SHA256 fdebaf31381c311ae4b3ec3254f7061bcba73ae3db5dbc51e25148388a997b4e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          2475cc44-6052-4cc5-a9ce-3495c61aeb66.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\2475cc44-6052-4cc5-a9ce-3495c61aeb66.tmp
                                          • Size 59B
                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          CURRENT
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Sync Data\LevelDB\CURRENT
                                          • Size 16B
                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png
                                          • Size 5KB
                                          • SHA256 63be4dfbc222f0c026579113af9aa7dea61e78a166ab9af053b46c1e172240ff
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\128.png
                                          • Size 3KB
                                          • SHA256 e8a4d1e6103287bd80fa5bad0418a550fcda7dc7418e9a2f5b7a8e2cd51ec1d5
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\192.png
                                          • Size 1KB
                                          • SHA256 434382805003287179ce1ced4422245ee09a7ccacbf5920758078614ccd9689a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\256.png
                                          • Size 6KB
                                          • SHA256 e207a2f9646cce24336294ad74beb9813c42f1ebf8ad6bee7ac6fedaa617ddf9
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\32.png
                                          • Size 1KB
                                          • SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\48.png
                                          • Size 1KB
                                          • SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\64.png
                                          • Size 2KB
                                          • SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_157402970\Icons\96.png
                                          • Size 2KB
                                          • SHA256 03d15ce246e276c1c2b6dd066cdda74bda3c79b61e5b9e18825d144d9c64c6fe
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\128.png
                                          • Size 1KB
                                          • SHA256 a57ffe3b3cd0a1bafe37e36daa89d2f9afb9446423cba25df883ab0f9aa8293a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\192.png
                                          • Size 1KB
                                          • SHA256 f25ab19c435c2cb43e7d86b9bf58f46ec8af6228bc4511d4c5cb9d23e1cc4c04
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\256.png
                                          • Size 4KB
                                          • SHA256 dee5357bd2992efefb04ed8bbb64dbf7becd768d75dff17dcb2b335c4fd2a903
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\32.png
                                          • Size 952B
                                          • SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\48.png
                                          • Size 1KB
                                          • SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\64.png
                                          • Size 1KB
                                          • SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_2020672929\Icons\96.png
                                          • Size 1KB
                                          • SHA256 f2b25026f9dde3d50479d07494efff95f79c2bfa6c7eff6867051a951d38f9e0
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\128.png
                                          • Size 2KB
                                          • SHA256 3a45652c64d2a35cad427fc4541ab36ac42f11425f2d996edc38a6498d98bae8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\192.png
                                          • Size 1KB
                                          • SHA256 56b7a8100c9fd352d2c25b6a9c9a05b47950cf5f84d07ab014a0b7cd2850e5a5
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\256.png
                                          • Size 4KB
                                          • SHA256 55d89ccdc27b413cc831f5496b0caf3ec390bc19270ec3294a5d2d38dec42c24
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\32.png
                                          • Size 960B
                                          • SHA256 c6fa451ecd1a8a9533801028bc70cf82ef48eba11bb835e53e6c530b43018938
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\48.png
                                          • Size 1KB
                                          • SHA256 3fc8b8392989fb26381f0a14bb356cae5f998a4dde004c06a51e974034f9ccfa
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\64.png
                                          • Size 1KB
                                          • SHA256 f6ff978b0f4c0d28e96b27b6242565480a73615b03a4b95640f8d20136fc2a91
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_548816276\Icons\96.png
                                          • Size 1KB
                                          • SHA256 84a6d2571ed487aec05288f204c16ef239a740d2dfb105bf781c6708b938cf00
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\128.png
                                          • Size 8KB
                                          • SHA256 fa0d73901ae74d2d2c01f26442a2d489abc53facb18d532c67846bcb2cc6877a
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\192.png
                                          • Size 5KB
                                          • SHA256 cca43d465fed69867dfec3ee1faa43fe3cfc4fb118e3762f9f4f318856f2664e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\256.png
                                          • Size 20KB
                                          • SHA256 ba50637a9a54c98264373add3ad0514b06e6ae59524a3f7a4552f556d1afb78f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\32.png
                                          • Size 1KB
                                          • SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\48.png
                                          • Size 2KB
                                          • SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\64.png
                                          • Size 3KB
                                          • SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_634598086\Icons\96.png
                                          • Size 5KB
                                          • SHA256 a5c76c56766d79ac0e66fbbf57806501919a63913fb224b0965041ec3645f9e0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_670228831\Icons\192.png
                                          • Size 2KB
                                          • SHA256 e401220b69a76a298b2e081a5424af69791a4caa3936af85d8862c05f4ced4a8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_670228831\Icons\256.png
                                          • Size 12KB
                                          • SHA256 6e8f581f4cee7f8f8af4a9e1059f0d3088b792de7045067d74254e2a6f1f9a6b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_670228831\Icons\32.png
                                          • Size 1KB
                                          • SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_670228831\Icons\48.png
                                          • Size 2KB
                                          • SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_670228831\Icons\64.png
                                          • Size 3KB
                                          • SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_670228831\Icons\96.png
                                          • Size 3KB
                                          • SHA256 00f563fcf365eb53a4037624ab3783dd6e19d2c6689c9892aa30ad2b16577848
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\128.png
                                          • Size 10KB
                                          • SHA256 fa08e93892e385bac323598be6f2ca5d50deced90b70ec1077ebf85cb9288a01
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\192.png
                                          • Size 6KB
                                          • SHA256 12ad601b8af3cbff9a865c088fbff78b77ab5c6c47e1dbed76b71c5d338b8c83
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\256.png
                                          • Size 25KB
                                          • SHA256 847ba4105ca81041b22fe8ce37df5581bef4f4cec7a5f2e7895705dc129ef5b1
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\32.png
                                          • Size 1KB
                                          • SHA256 97bbe02ee0327548d5b3bf2b6f00b507ca4425425e04f95e072b3617b3e4e6bd
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\48.png
                                          • Size 2KB
                                          • SHA256 444572dc6fc2eb8f1a880711379a0ec4a80d041549fad959fb5678b4c0b08689
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\64.png
                                          • Size 3KB
                                          • SHA256 bc6ae87a22ff2fe7feca2cb3f83aaebc8f02ad707cda77b51dab26bc9c5be710
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_883850101\Icons\96.png
                                          • Size 6KB
                                          • SHA256 56a5a2bbd83b4840d2b6f04fea4f3e9b45245404a5fff83cd7e594e423055a7e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          128.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\128.png
                                          • Size 2KB
                                          • SHA256 f127267b7d6f1ef83d170f6460343638b3b48d3f96f4bf8dd2896418dfa36c7c
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          192.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\192.png
                                          • Size 1KB
                                          • SHA256 2ae1736c46f88d30ded3748674c469f6ebd5f824b167abc77511d1a17204a767
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          256.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\256.png
                                          • Size 5KB
                                          • SHA256 f214b739d59d1aa2edb41c8809d8132dc5a5775f66c1725e849b9d5f45f8b017
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          32.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\32.png
                                          • Size 1KB
                                          • SHA256 23fb4d1613fb426612119928a7222ca84a9cba4ba081a8b1be7f2565c013c590
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          48.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\48.png
                                          • Size 1KB
                                          • SHA256 7b1aa50219251762867246b79677fac99c1b61a4ef4e471ae3473c10ada2c50b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          64.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\64.png
                                          • Size 1KB
                                          • SHA256 2a560cdee5965876269d30cf82a85b83aeac16903d4f325209ca3354b971c25b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          96.png
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\Web Applications\Temp\scoped_dir636_97175826\Icons\96.png
                                          • Size 1KB
                                          • SHA256 1ddb7863b4ff09dd3185943cce8261b98d230f7a239df307a4600ab0c20a8322
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          d822956b-ea35-464f-8ab0-641b3c6774a9.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\d822956b-ea35-464f-8ab0-641b3c6774a9.tmp
                                          • Size 9KB
                                          • SHA256 8fa36232f14ce0fab54d398fd19ed8d495d77109da510997c76fa58fa566df5f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          f0934490-58a5-49f5-80b5-6605e6ba2f86.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Default\f0934490-58a5-49f5-80b5-6605e6ba2f86.tmp
                                          • Size 17KB
                                          • SHA256 70c05973682a777b4d477899cd0d847a83a5ae264837880c90c7474409cdc34b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          DevToolsActivePort
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\DevToolsActivePort
                                          • Size 60B
                                          • SHA256 3bac26ffe66229bfa518ad71b07b889eb737544b0549b2fca1f8882535dbfcd8
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          Local State
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\Local State
                                          • Size 1KB
                                          • SHA256 5bc7f75a83ad245c64410c03650c62d698c1ff561f6100444593b529f5d4733e
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          a2cdf57a-bfce-4588-939f-19d9382891c7.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\a2cdf57a-bfce-4588-939f-19d9382891c7.tmp
                                          • Size 3KB
                                          • SHA256 a4ac46fefbafd62827b923225b2f0c383032b47448d8986518d61cb66c9e496a
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          e68434ad-71fb-4000-a567-7c87ef717778.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\e68434ad-71fb-4000-a567-7c87ef717778.tmp
                                          • Size 146KB
                                          • SHA256 27c3a610f4298ab793cf1a5883d5296549fcbd8df90dce7460a9233a1fda8357
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          eed16c7d-f286-488f-8d14-44ba77f0d5ef.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\eed16c7d-f286-488f-8d14-44ba77f0d5ef.tmp
                                          • Size 144KB
                                          • SHA256 c27c35f4a0137206585815b10860f283350c2be2a1e0103ba86dd89ee2595244
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          f7c0e6c5-c8e2-4ea6-967f-cac6846d53c2.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\extensions_crx_cache\f7c0e6c5-c8e2-4ea6-967f-cac6846d53c2.tmp
                                          • Size 13B
                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          f752dae9-e2e1-46d4-a511-d208a62c2771.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\agy_encoder_chrome_profile\f752dae9-e2e1-46d4-a511-d208a62c2771.tmp
                                          • Size 144KB
                                          • SHA256 7f5ea2a46572bc41b90fcb744f6dc381328170d6e991df97b3478b7cd8088c8e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          messages.json
                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir636_1590783583\CRX_INSTALL\_locales\en\messages.json
                                          • Size 450B
                                          • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          f3f9e021-c4fd-49a7-a3ea-15f3d0185366.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir636_1590783583\f3f9e021-c4fd-49a7-a3ea-15f3d0185366.tmp
                                          • Size 242KB
                                          • SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          213804ae-77d1-45a5-ad67-3e45123b258c.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir636_397761922\213804ae-77d1-45a5-ad67-3e45123b258c.tmp
                                          • Size 158KB
                                          • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          messages.json
                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir636_397761922\CRX_INSTALL\_locales\en_CA\messages.json
                                          • Size 711B
                                          • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          PushShow.docm
                                          • Path C:\Users\Admin\Desktop\PushShow.docm
                                          • Size 778KB
                                          • SHA256 61d6ceb939e1f256f414dfd4adbc49658bda43aa54627b1506685d1af91144e4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SearchSuspend.docm
                                          • Path C:\Users\Admin\Desktop\SearchSuspend.docm
                                          • Size 774KB
                                          • SHA256 bfd19e596f473f5459368c048cc874669d5e0cc12923cd66ef5240a6cd187e8b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          RenameSwitch.docm
                                          • Path C:\Users\Admin\Documents\RenameSwitch.docm
                                          • Size 771KB
                                          • SHA256 9bb10cc00541fa6d0ca7bc920644485863e3848e97e8dd5dd94105f107dc094d
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          perfhost.exe
                                          • Path C:\Windows\SysWOW64\perfhost.exe
                                          • Size 1.5MB
                                          • SHA256 7de2ad1f61c821272b49acf699cf5028ba5aff1f08ad47374c46b6ca50e85b49
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          AgentService.exe
                                          • Path C:\Windows\System32\AgentService.exe
                                          • Size 1.7MB
                                          • SHA256 cd3fcfd0ddd970c9e352dc6ff0cadad0b8792a58ef4664315478fef2b7724147
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          AgentService.exe
                                          • Path C:\Windows\System32\AgentService.exe
                                          • Size 2.5MB
                                          • SHA256 170f805cae41b531bc5b5d0822490099bedfefebdbd0b6c234d64a2d4bab9397
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Locator.exe
                                          • Path C:\Windows\System32\Locator.exe
                                          • Size 1.5MB
                                          • SHA256 dbdcfe148f33594daaea09f8ac4340e22dd861226a777d9ad8ddd66760b8a8dd
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          ssh-agent.exe
                                          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                                          • Size 1.8MB
                                          • SHA256 f9f0c20d038ca3524e09a7bd7dde46a6340990471bdf4638d65262727816a75e
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          PerceptionSimulationService.exe
                                          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                                          • Size 1.6MB
                                          • SHA256 a38ec04a30ad39c7b48b862523228a1281bb8adb4a4be252ff7799780eb8e7c7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SearchIndexer.exe
                                          • Path C:\Windows\System32\SearchIndexer.exe
                                          • Size 1.4MB
                                          • SHA256 3b4e8241316d80f5e3733a08e83482329dcaaac2ff3940e20c30dfee5a9a09cd
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SensorDataService.exe
                                          • Path C:\Windows\System32\SensorDataService.exe
                                          • Size 1.8MB
                                          • SHA256 5ac2df446b34691e4ee84df916f30097043749b2322501037cc452d3d2c88998
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SgrmBroker.exe
                                          • Path C:\Windows\System32\SgrmBroker.exe
                                          • Size 2.5MB
                                          • SHA256 1eddc3617049147841d4827a1b66b31b208aaa24adf38dfe87d535608b55e086
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          Spectrum.exe
                                          • Path C:\Windows\System32\Spectrum.exe
                                          • Size 1.4MB
                                          • SHA256 f2ab3a04f13c48eecff2ae61a5d980081ba77094d8b47e3a0cd5189aaad4f33b
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          TieringEngineService.exe
                                          • Path C:\Windows\System32\TieringEngineService.exe
                                          • Size 1.8MB
                                          • SHA256 7b864b71db07b0e8e6d8e690d9e2038b2873d7ee157f2787cfb98f5237c5ad20
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          VSSVC.exe
                                          • Path C:\Windows\System32\VSSVC.exe
                                          • Size 2.0MB
                                          • SHA256 4e6b0ccfc6765cd065c4d8fef9bb87ad3027fd7023bc661dacdca450dcde8424
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          alg.exe
                                          • Path C:\Windows\System32\alg.exe
                                          • Size 850KB
                                          • SHA256 46da836a94fbf16b56c2af82eb95f7bc08d913af1e0b68f875e2f985c7799299
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          msdtc.exe
                                          • Path C:\Windows\System32\msdtc.exe
                                          • Size 1.6MB
                                          • SHA256 37d56b53bb6358e9f51194c04456d22f29981240d2c79c66a3f71daa572bab7f
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          msiexec.exe
                                          • Path C:\Windows\System32\msiexec.exe
                                          • Size 2.3MB
                                          • SHA256 e7ef90fec6475d2c087a554650c0f7e78a31b2241b380593bae825e61c561620
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          snmptrap.exe
                                          • Path C:\Windows\System32\snmptrap.exe
                                          • Size 1.5MB
                                          • SHA256 16078abd2e3408c0fc88f15d47a4d5449b1c5ff9eade6c5bfec73123f2f94970
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          vds.exe
                                          • Path C:\Windows\System32\vds.exe
                                          • Size 1.3MB
                                          • SHA256 eb573c5e29243a89375678976905f91c8ffbbe95ca37edf703ee46446e0f8199
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          WmiApSrv.exe
                                          • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                          • Size 1.7MB
                                          • SHA256 a440f0cf7cf028ed4284cc34c0f680fc75fde98aadfd875139570d8a62872af8
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          wbengine.exe
                                          • Path C:\Windows\System32\wbengine.exe
                                          • Size 2.1MB
                                          • SHA256 c27e1ad30fe301eed898c9acd56c6703d57fc0cd9f3f9503292dfff205417d69
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          AgentService.exe
                                          • Path C:\Windows\system32\AgentService.exe
                                          • Size 2.5MB
                                          • SHA256 e71c94e18dcd1e0db17acce20918d4e1ae98e26b19c618c64fc37c86ccbd5af0
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          AppVClient.exe
                                          • Path C:\Windows\system32\AppVClient.exe
                                          • Size 1.5MB
                                          • SHA256 76cefadbf93744ca2140c8a1b665fce52b280909d80c3747022c425b2615ace4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          DiagnosticsHub.StandardCollector.Service.exe
                                          • Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                                          • Size 849KB
                                          • SHA256 3bdc717f325fe529661cb32ca6747f52352aa07cccc04ae21c458c3088c32a0c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          SgrmBroker.exe
                                          • Path C:\Windows\system32\SgrmBroker.exe
                                          • Size 2.5MB
                                          • SHA256 5288e0adae9ea294357dd75dd871ea39cec6f0b8886dabd6e9d0b3b91dff377c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          fxssvc.exe
                                          • Path C:\Windows\system32\fxssvc.exe
                                          • Size 1.4MB
                                          • SHA256 8c55c276ddcd840ec3ef64830cfaff16e71ee6271b4ea476dcfbbbffcebe1522
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          msiexec.exe
                                          • Path C:\Windows\system32\msiexec.exe
                                          • Size 2.3MB
                                          • SHA256 9c89e45291d40ca837bf009c4d60ba6d77973160bbf68becc587b30ce7f3ede5
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          memory/1516-62-0x0000000001A50000-0x0000000001AB0000-memory.dmp
                                          Download

                                          memory/1516-65-0x0000000001A50000-0x0000000001AB0000-memory.dmp
                                          Download

                                          memory/1516-56-0x0000000001A50000-0x0000000001AB0000-memory.dmp
                                          Download

                                          memory/1696-308-0x0000000001A20000-0x0000000001A30000-memory.dmp
                                          Download

                                          memory/1696-326-0x0000000009E60000-0x0000000009E68000-memory.dmp
                                          Download

                                          memory/1696-292-0x0000000001770000-0x0000000001780000-memory.dmp
                                          Download

                                          memory/1872-1501-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1522-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1440-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1442-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1443-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1450-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1451-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1449-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1448-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1447-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1446-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1445-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1444-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1490-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1491-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1492-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1495-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1494-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1493-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1439-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1505-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1504-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1503-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1502-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1500-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1499-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1498-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1497-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1496-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1436-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1441-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1523-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1524-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1527-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1526-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1525-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1529-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1528-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1437-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/1872-1438-0x00000141134F0000-0x0000014113500000-memory.dmp
                                          Download

                                          memory/2096-72-0x00000000007C0000-0x0000000000820000-memory.dmp
                                          Download

                                          memory/2096-78-0x00000000007C0000-0x0000000000820000-memory.dmp
                                          Download

                                          memory/2564-91-0x0000000000B20000-0x0000000000B80000-memory.dmp
                                          Download

                                          memory/2564-85-0x0000000000B20000-0x0000000000B80000-memory.dmp
                                          Download

                                          memory/2948-264-0x0000000000D90000-0x0000000000DF0000-memory.dmp
                                          Download

                                          memory/2948-270-0x0000000000D90000-0x0000000000DF0000-memory.dmp
                                          Download

                                          memory/3440-52-0x0000000000890000-0x00000000008F0000-memory.dmp
                                          Download

                                          memory/3440-45-0x0000000000890000-0x00000000008F0000-memory.dmp
                                          Download

                                          memory/3620-258-0x00000000004D0000-0x0000000000530000-memory.dmp
                                          Download

                                          memory/3620-252-0x00000000004D0000-0x0000000000530000-memory.dmp
                                          Download

                                          memory/3972-40-0x0000000000440000-0x00000000004A0000-memory.dmp
                                          Download

                                          memory/3972-34-0x0000000000440000-0x00000000004A0000-memory.dmp
                                          Download

                                          memory/4548-116-0x0000000000770000-0x00000000007D7000-memory.dmp
                                          Download

                                          memory/4548-121-0x0000000000770000-0x00000000007D7000-memory.dmp
                                          Download

                                          memory/5092-18-0x0000000002B20000-0x0000000002B80000-memory.dmp
                                          Download

                                          memory/5092-0-0x0000000000830000-0x00000000008B3000-memory.dmp
                                          Download

                                          memory/5092-12-0x0000000002B20000-0x0000000002B80000-memory.dmp
                                          Download

                                          memory/5092-6-0x0000000000830000-0x00000000008B3000-memory.dmp
                                          Download