Overview

overview

9

Static

static

3

WarpDeskDe...er.exe

windows10-2004-x64

9

WarpDeskDe...er.exe

windows11-ltsc_2024-x64

7

Resubmissions

10/11/2026, 04:26

261110-e2plhayzav9

10/11/2026, 04:23

261110-ezzcxstw3m7

Analysis

  • user interaction
    yes
  • max time kernel
    60s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WarpDeskDesktop-x64-1.0.91-installer.exe
  • Size 28.9MB
  • Sample261110-e2plhayzav
  • SHA256 daa6b690a17e1c775a1084b686605a637a864bd943498530de41330c5ec01d9b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 1 IoCs
    defense_evasion
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Service Discovery 1 TTPs 9 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 13 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WarpDeskDesktop-x64-1.0.91-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\WarpDeskDesktop-x64-1.0.91-installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Windows\SysWOW64\tasklist.exe
      tasklist /FI "IMAGENAME eq warpdesk.exe" /FO CSV /NH
      2⤵
      • Discovers running processes
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:540
    • C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\warpdesk.exe
      "C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\warpdesk.exe"
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VMWare services registry key.
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Reads the TCP/IP host and domain name from the registry
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=1340.3968.9461990535831163017
        3⤵
        • Network Service Discovery
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:3980
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff902e0b078,0x7ff902e0b084,0x7ff902e0b090
          4⤵
          • Network Service Discovery
          PID:2140
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1736,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:2
          4⤵
          • Network Service Discovery
          PID:984
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1696,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
          4⤵
          • Network Service Discovery
          PID:1644
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
          4⤵
          • Network Service Discovery
          PID:2128
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
          4⤵
          • Network Service Discovery
          PID:212
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4020,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:1
          4⤵
          • Network Service Discovery
          PID:4244
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2196,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
          4⤵
          • Network Service Discovery
          PID:4324
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView" --webview-exe-name=warpdesk.exe --webview-exe-version=1.0.91 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4128,i,18121463297608801331,9969044695124631851,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
          4⤵
          • Network Service Discovery
          PID:2692
      • C:\Windows\system32\rundll32.exe
        rundll32 url.dll,FileProtocolHandler https://warpdesk.app/auth/login?desktopOauthRedirect=http%3A%2F%2F127.0.0.1%3A27090%2Fcallback%3F_nonce%3Decbb10149dcc2484bd2348f4b8556ab0
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://warpdesk.app/auth/login?desktopOauthRedirect=http%3A%2F%2F127.0.0.1%3A27090%2Fcallback%3F_nonce%3Decbb10149dcc2484bd2348f4b8556ab0
          4⤵
          • Enumerates system info in registry
          • Suspicious use of WriteProcessMemory
          PID:4924
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ff90082c188,0x7ff90082c194,0x7ff90082c1a0
            5⤵
              PID:1532
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14496814174274915642,10996654626495684209,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
              5⤵
              • System Time Discovery
              PID:1696
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,15941655294613622852,8660339880061167755,262144 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
              5⤵
                PID:4300
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,12255796847813685150,3607820251882700246,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
                5⤵
                  PID:4388
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,16429983240062667335,11844648709740310872,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                  5⤵
                    PID:4728
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13068940265043579417,10752259055140079352,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                    5⤵
                      PID:4656
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,8988583382625004293,9126418992361777416,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
                      5⤵
                        PID:2512
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,9388021354570844965,7637372819506150158,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
                        5⤵
                          PID:1572
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,17444847764315371302,16314939535971459705,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                          5⤵
                            PID:4324
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14271737887984289019,17039424853258310538,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
                            5⤵
                              PID:3604
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,11974333968513524565,16228565328683072274,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
                              5⤵
                                PID:5316
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12194164179852577060,11144818884969890371,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
                                5⤵
                                  PID:5324
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6524,i,7439184092707702968,18213163141079294023,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
                                  5⤵
                                    PID:5568
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,2046483509292572253,14499324648728947372,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
                                    5⤵
                                      PID:6048
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,2046483509292572253,14499324648728947372,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:8
                                      5⤵
                                        PID:5128
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13560030075381588018,4365331251531102989,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
                                        5⤵
                                          PID:5688
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,1999191905864715844,16654477894327276735,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:8
                                          5⤵
                                            PID:5720
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,7391946011020649186,12503742835325172646,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
                                            5⤵
                                              PID:5908
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,1782690129221570625,14425049928738263451,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
                                              5⤵
                                                PID:5500
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,14196026101452768733,1304762975730417074,524288 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
                                                5⤵
                                                  PID:5548
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6820,i,15627370536666655111,4404353574328663064,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
                                                  5⤵
                                                    PID:6020
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6364,i,4832245926777798427,12966225762990663630,2097152 --field-trial-handle=2416,i,6250920924295228248,5209636214295116717,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
                                                    5⤵
                                                      PID:6016
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                              1⤵
                                                PID:3604

                                              Network

                                                    MITRE ATT&CK Enterprise v16

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    protocols.json
                                                    • Path C:\Program Files\chrome_Unpacker_BeginUnzipping3980_1310176656\protocols.json
                                                    • Size 3KB
                                                    • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    36bcefd2-7aa7-44c4-80e9-a94b0d4f720a.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36bcefd2-7aa7-44c4-80e9-a94b0d4f720a.tmp
                                                    • Size 8KB
                                                    • SHA256 3375363d56c51515fdca03893c6697c2ae003eeb1ae71694a85a415fcd77e536
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    3edc511f-69b0-4257-b05c-e27054923d7c.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3edc511f-69b0-4257-b05c-e27054923d7c.tmp
                                                    • Size 8KB
                                                    • SHA256 de4d6191d1b3283734c65872dcc65734add9e03a8a5a3037d349dd41b17b6af5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    80a7e070-9399-46a3-a15f-24ef388a9503.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80a7e070-9399-46a3-a15f-24ef388a9503.tmp
                                                    • Size 18KB
                                                    • SHA256 952d70b4ffec68bfa2b9e74f95775a4d6e3f6fcb1faaad390356e79d7a2195a6
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 86788ca5ca7fef7f10083df937e9ae5d0b7ad97c73a11bd065eab327a3a3accc
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    400f8d73-c948-4fcf-a36d-de33670c039d.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\400f8d73-c948-4fcf-a36d-de33670c039d.tmp
                                                    • Size 11KB
                                                    • SHA256 80daf1026697a00f18986eaf995b200853250758f74e1b65b54f209d1971e66b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    412d7979-41b4-4f3a-97a2-47e49ac76d65.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\412d7979-41b4-4f3a-97a2-47e49ac76d65.tmp
                                                    • Size 70KB
                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    9a52b79d-2f84-4ec1-bf63-85afb291380b.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a52b79d-2f84-4ec1-bf63-85afb291380b.tmp
                                                    • Size 32KB
                                                    • SHA256 b6ed7671d41f3f5ac9e766a854c4de368fa367f747327b27dd24e6d3a41d063d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    f_000068
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
                                                    • Size 28KB
                                                    • SHA256 19f9c92546aa300c312235e3125af1b81394d8db9a4bc4a425cd5b641d2d54e1
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    f_000069
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
                                                    • Size 75KB
                                                    • SHA256 a79fdb52d4a5c76552452f69202add96e287401fff03d3e8c0e38b4dcb5a99cd
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    f_00006a
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
                                                    • Size 101KB
                                                    • SHA256 7c1d1c8187508ae032a7c52cce1afeb12c91478cb9afd78b8fd0248695521470
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    f_00006d
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
                                                    • Size 351KB
                                                    • SHA256 3fe90e0e5787638faec9dbbe15ffed7f89575f952316d1aa1b4b1efd7f311f9e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    temp-index
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                    • Size 4KB
                                                    • SHA256 5d50758cc381c9669f184773fc5bd01505bb0c7bcb39279e69ff54762cb7daab
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 3KB
                                                    • SHA256 8aaa65019d5d721fb0517c24e06aef1b6ca126e1295a25cd1e8d9cbc3fead87c
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    9c060b6f-e87e-4246-b34a-749abdc561cf.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9c060b6f-e87e-4246-b34a-749abdc561cf.tmp
                                                    • Size 2B
                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    dasherSettingSchema.json
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
                                                    • Size 854B
                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    43d1d2fa-a25a-4f8b-bfef-fe1d219399db.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43d1d2fa-a25a-4f8b-bfef-fe1d219399db.tmp
                                                    • Size 6KB
                                                    • SHA256 971dd9738bab2b8034a8a8495f65c04a29730622562b2d3ef37f3ddbe817dd09
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    6ffd1575-bb70-4e7c-a669-4faa51dc7351.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ffd1575-bb70-4e7c-a669-4faa51dc7351.tmp
                                                    • Size 111B
                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    cecfff66-0083-42fb-a7b1-d0400bce9f03.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cecfff66-0083-42fb-a7b1-d0400bce9f03.tmp
                                                    • Size 40B
                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    edf2a9ff-cf22-4d51-8558-44c747df354a.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\edf2a9ff-cf22-4d51-8558-44c747df354a.tmp
                                                    • Size 10KB
                                                    • SHA256 3c2fdde603a55e60e3016d48fe3cad935ceb28cb85cdc84167c0f00c84ab982e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                    • Size 23KB
                                                    • SHA256 1783bebee946a1e661a946c397cd3b9001995819640a15dbc7d3abf93e90d1d0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    09e65c26-979f-45b6-ab88-afef7024de2b.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\09e65c26-979f-45b6-ab88-afef7024de2b.tmp
                                                    • Size 13B
                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                    • Size 2KB
                                                    • SHA256 070c9b2e774eb6820ab2d2e07ac7682557c183df097fa8e4e663ce136c33f933
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    libffi-8.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libffi-8.dll
                                                    • Size 38KB
                                                    • SHA256 f96cf79b75f33a10023d001673b564538023395c94b3c58e1db53114976a7c25
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgcc_s_seh-1.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgcc_s_seh-1.dll
                                                    • Size 148KB
                                                    • SHA256 80940372431cc76224dfda06e2d33f01e49af3b4e7c499c535be856ebcadd273
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libglib-2.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libglib-2.0-0.dll
                                                    • Size 1.5MB
                                                    • SHA256 642d4da7a378374a84b1edc30100b9e9c7b798e53347853aadd1c86691a81468
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgmodule-2.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgmodule-2.0-0.dll
                                                    • Size 22KB
                                                    • SHA256 4a3e1bf8b17425c58be37d0a2bda2340364e19d18320f414a6537a3069867ad4
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgobject-2.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgobject-2.0-0.dll
                                                    • Size 349KB
                                                    • SHA256 516bef266569d691924097224502e45ea04f6cd423bdfa23251f609007b9fb0e
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgstapp-1.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgstapp-1.0-0.dll
                                                    • Size 96KB
                                                    • SHA256 d2b4cb10ea62112fa69ba9057973d5974c91da51beb828e6e36d4bdddfb7159b
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgstbase-1.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgstbase-1.0-0.dll
                                                    • Size 533KB
                                                    • SHA256 32ee68a1dd186e2a4c16ad34ca657871f157d4f49ff0c9e3aedecd238a3b0fe0
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgstreamer-1.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgstreamer-1.0-0.dll
                                                    • Size 1.4MB
                                                    • SHA256 d15f3aa1430a09ac20a9c0b0377f2633753bce7dd8fdca7be01ad99b9f33cc09
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libgstvideo-1.0-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libgstvideo-1.0-0.dll
                                                    • Size 900KB
                                                    • SHA256 b1136531cf1dc894a0ede15b003cdc34680df6ad92f09de5b67b230886c81e9f
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libiconv-2.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libiconv-2.dll
                                                    • Size 1.1MB
                                                    • SHA256 94ec68fb8d342b6c91b6b48a8d95092819cdcd006a7166e0b68062f946afd08a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libintl-8.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libintl-8.dll
                                                    • Size 291KB
                                                    • SHA256 0e5a178731e6be6d115442a6ade3df7f03265cd1fc4338f8b6f86a8001cbf582
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    liborc-0.4-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\liborc-0.4-0.dll
                                                    • Size 576KB
                                                    • SHA256 3de234a79adca21786504e3de0ec4c615b821ff06c84ca1e9ab06d4920332385
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libpcre2-8-0.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libpcre2-8-0.dll
                                                    • Size 689KB
                                                    • SHA256 752f04bb7a60d2a049788ffaec14b45602c4dec4c29534001dfcf434d26da19c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    libwinpthread-1.dll
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\libwinpthread-1.dll
                                                    • Size 61KB
                                                    • SHA256 bbe82da090a3a135eb4209466142e28e97fc9d61d8d4070a8585cbc8a15ab970
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    warpdesk.exe
                                                    • Path C:\Users\Admin\AppData\Local\Programs\WarpDesk Desktop\warpdesk.exe
                                                    • Size 20.7MB
                                                    • SHA256 e1e421faa736d84693af3f761be91462015a83b07f4084143a5c5b10e839f5c2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    02fb1e21-9d68-46da-837e-50f1f4820998.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\02fb1e21-9d68-46da-837e-50f1f4820998.tmp
                                                    • Size 158KB
                                                    • SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    9835ea60-3003-4a77-bcb6-13d5eb65e4bd.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\9835ea60-3003-4a77-bcb6-13d5eb65e4bd.tmp
                                                    • Size 1B
                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    InstallOptions.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\InstallOptions.dll
                                                    • Size 15KB
                                                    • SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    SimpleSC.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\SimpleSC.dll
                                                    • Size 1.1MB
                                                    • SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    System.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\System.dll
                                                    • Size 12KB
                                                    • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    ioSpecial.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\ioSpecial.ini
                                                    • Size 1KB
                                                    • SHA256 2e4f261d49662e0f7e11fd8e5861a0efd54c1cb247335b99aff766b3934b6e6f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ioSpecial.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\ioSpecial.ini
                                                    • Size 1KB
                                                    • SHA256 34662821b20a9c4bbb693e034efb57329e1e51f2158a1c846b55e6d907fbabd9
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    ioSpecial.ini
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\ioSpecial.ini
                                                    • Size 1KB
                                                    • SHA256 799ba0ff12ce622bd33f2736679e217c67e7c57ef682e5e8eced71d3be4c56e3
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    modern-wizard.bmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\modern-wizard.bmp
                                                    • Size 25KB
                                                    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    nsDialogs.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\nsDialogs.dll
                                                    • Size 9KB
                                                    • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    nsExec.dll
                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsj5CB2.tmp\nsExec.dll
                                                    • Size 7KB
                                                    • SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    messages.json
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_1044522319\CRX_INSTALL\_locales\en_CA\messages.json
                                                    • Size 711B
                                                    • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    verified_contents.json
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_873175580\CRX_INSTALL\_metadata\verified_contents.json
                                                    • Size 1KB
                                                    • SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    content.js
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_873175580\CRX_INSTALL\content.js
                                                    • Size 9KB
                                                    • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    manifest.json
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_873175580\CRX_INSTALL\manifest.json
                                                    • Size 962B
                                                    • SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    cb7831bd-d0c3-4c18-9f63-353285c51a88.tmp
                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4924_873175580\cb7831bd-d0c3-4c18-9f63-353285c51a88.tmp
                                                    • Size 10KB
                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    3aa4edda-f58a-41c8-8a29-5660dfcee1b5.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\3aa4edda-f58a-41c8-8a29-5660dfcee1b5.tmp
                                                    • Size 16KB
                                                    • SHA256 839e5ea46fdcc50c6dbe11b44b55360c9d062dab06fc1c8dccf29fe39cdcaaa3
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    643bbf9a-bcce-4866-827d-5b43561f4e45.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\643bbf9a-bcce-4866-827d-5b43561f4e45.tmp
                                                    • Size 1KB
                                                    • SHA256 96ca123770006e0a7b7f2d143b1c83ab929abb40e31ddb27ea48ad6256352648
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    89ee100f-f30e-4871-9453-9daa4651c0ff.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\89ee100f-f30e-4871-9453-9daa4651c0ff.tmp
                                                    • Size 16KB
                                                    • SHA256 3f87a051de917c03a6688685bfc5ab6fe2eef9bda5fffe94058505cb6689b568
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    manifest.fingerprint
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.fingerprint
                                                    • Size 66B
                                                    • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    manifest.json
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                    • Size 135B
                                                    • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 cf8a7046ac3f6bc7bd5a455f765e56fe17b2d7fdd067baf81dd9d4f071bd011f
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    settings.dat
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Crashpad\settings.dat
                                                    • Size 280B
                                                    • SHA256 151797323b67f3b5d9c0ba3c9a2188cf010590b7bff9b660f0fc491e1477bb01
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    throttle_store.dat
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Crashpad\throttle_store.dat
                                                    • Size 20B
                                                    • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    143c9193-65ae-4329-8071-588e7460545b.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\143c9193-65ae-4329-8071-588e7460545b.tmp
                                                    • Size 6KB
                                                    • SHA256 9bf388409d5f504553b00eb3462546447ef04b9c2858ec10c70987814fc1bf61
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    342c72ef-62cf-4853-8262-05f9ac6e05f8.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\342c72ef-62cf-4853-8262-05f9ac6e05f8.tmp
                                                    • Size 6KB
                                                    • SHA256 4e4899ce010c18d156a3d9c768cd4ba41c42567a175d449a3bf035017e19ce93
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    temp-index
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
                                                    • Size 72B
                                                    • SHA256 4300ab72f5f45cd59de34f9a5b8674792593fea84f554095ad7c0eab8dba083f
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    the-real-index
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                    • Size 48B
                                                    • SHA256 836779c49775e3d36fa6914be88bf0267fb0aa2f6441cfc780bbf5ce0e16cab3
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    index
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\DawnWebGPUCache\index
                                                    • Size 256KB
                                                    • SHA256 3f74bd41915207ac207c8c205a49c398b687f97b6b1d56e427a679ce81dfbaf0
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    MANIFEST-000001
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
                                                    • Size 41B
                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    data_0
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\GPUCache\data_0
                                                    • Size 8KB
                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_1
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\GPUCache\data_1
                                                    • Size 264KB
                                                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_2
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\GPUCache\data_2
                                                    • Size 8KB
                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    data_3
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\GPUCache\data_3
                                                    • Size 8KB
                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                    • MD5 SHA1 SHA512 SSDEEP
                                                    Submit Download

                                                    09e4d90e-5a54-4fdf-80ab-19ec37a740a1.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\Network\09e4d90e-5a54-4fdf-80ab-19ec37a740a1.tmp
                                                    • Size 821B
                                                    • SHA256 1583ec61823b4a8abd4e21f43a47e63d62f9bc8a1b6f4a2d889f7740be68eeff
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    SCT Auditing Pending Reports
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                    • Size 2B
                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    CURRENT
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
                                                    • Size 16B
                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                    • MD5 SHA1 SHA512
                                                    Submit Download

                                                    Local State
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\Local State
                                                    • Size 1KB
                                                    • SHA256 a687d13c24d60d877d5ce3d96f22488688053eb667c9608ff06df5a84fd6c538
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    a189e0ae-8b01-4ec8-b773-d50d9590049a.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\a189e0ae-8b01-4ec8-b773-d50d9590049a.tmp
                                                    • Size 3KB
                                                    • SHA256 7e4c5d1ee5e596eb803139c8bcae87edeab177262e035673105618129e24944a
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    c15f287a-bc4f-4539-9017-ee5b8a10b24c.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\c15f287a-bc4f-4539-9017-ee5b8a10b24c.tmp
                                                    • Size 16KB
                                                    • SHA256 f9acbd8a3e31ad2711661403ba989875b42e82455024b57abd5ee4e77483db7a
                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                    Submit Download

                                                    d344aeec-b57d-40a1-b16c-8654404be01f.tmp
                                                    • Path C:\Users\Admin\AppData\Roaming\warpdesk.exe\EBWebView\d344aeec-b57d-40a1-b16c-8654404be01f.tmp
                                                    • Size 2KB
                                                    • SHA256 1d00945936794fbbb9a07fc45641211ec49f32b25f223c5fd9258202b3bc3015
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    WarpDesk Desktop.lnk
                                                    • Path C:\Users\Admin\Desktop\WarpDesk Desktop.lnk
                                                    • Size 1KB
                                                    • SHA256 8fcd67f836b5b72924458a2c4e35f08402d1cc8788ac070eaa67d6b90b255bcd
                                                    • MD5 SHA1 SHA512 TLSH
                                                    Submit Download

                                                    memory/212-553-0x00007FF91FDA0000-0x00007FF91FDA1000-memory.dmp
                                                    Download

                                                    memory/984-415-0x00007FF91FDA0000-0x00007FF91FDA1000-memory.dmp
                                                    Download

                                                    memory/1340-635-0x00007FF9039A0000-0x00007FF9039F2000-memory.dmp
                                                    Download

                                                    memory/1340-766-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-630-0x00007FF912400000-0x00007FF912410000-memory.dmp
                                                    Download

                                                    memory/1340-628-0x00007FF903C60000-0x00007FF903CE7000-memory.dmp
                                                    Download

                                                    memory/1340-631-0x00007FF903AC0000-0x00007FF903AEA000-memory.dmp
                                                    Download

                                                    memory/1340-632-0x00007FF903A20000-0x00007FF903AB5000-memory.dmp
                                                    Download

                                                    memory/1340-633-0x00007FF912050000-0x00007FF91205D000-memory.dmp
                                                    Download

                                                    memory/1340-1309-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-1625-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-634-0x00007FF903A00000-0x00007FF903A15000-memory.dmp
                                                    Download

                                                    memory/1340-636-0x00007FF903880000-0x00007FF90399E000-memory.dmp
                                                    Download

                                                    memory/1340-620-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-1590-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-627-0x00007FF903CF0000-0x00007FF903DA2000-memory.dmp
                                                    Download

                                                    memory/1340-626-0x00007FF903DB0000-0x00007FF903E90000-memory.dmp
                                                    Download

                                                    memory/1340-629-0x00007FF903AF0000-0x00007FF903C57000-memory.dmp
                                                    Download

                                                    memory/1340-1456-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-1575-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-625-0x00007FF904900000-0x00007FF90495B000-memory.dmp
                                                    Download

                                                    memory/1340-1487-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-1502-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-1517-0x00007FF603C50000-0x00007FF60715D000-memory.dmp
                                                    Download

                                                    memory/1340-624-0x00007FF905890000-0x00007FF9058AB000-memory.dmp
                                                    Download

                                                    memory/1340-623-0x00007FF903E90000-0x00007FF904013000-memory.dmp
                                                    Download

                                                    memory/2128-500-0x00007FF920AE0000-0x00007FF920AE1000-memory.dmp
                                                    Download

                                                    memory/2128-501-0x00007FF920640000-0x00007FF920641000-memory.dmp
                                                    Download

                                                    memory/4660-9-0x00000000028F0000-0x0000000002A0C000-memory.dmp
                                                    Download

                                                    memory/5128-1453-0x0000024AB76D0000-0x0000024AB7A8B000-memory.dmp
                                                    Download

                                                    memory/5128-1328-0x0000024AB76D0000-0x0000024AB7A8B000-memory.dmp
                                                    Download