dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
Size 2.2MB
Sample260527-m678eaet5x
SHA256 dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865
MD5 80a2eaf9c07b89fa04936a62effc804d
SHA1 6571de9cc7d3429b9b063b4ff2ec34b0bdc95b09
SHA512 204b30628955112d8690ff556ff98832c1c803872cdbe43beb89447ed1e3454f8382c31230c148a601c37fd6b11f48aae329a14de556bf10f84fd6a76128b140
SSDEEP 49152:lAyx2bOQYg3sJfJfL1k7mpkb8MnG/wSsPn3Xt7Uv+MnIIC:2BbOQDiJfO7Jb8MnG/wlGGMnI
TLSH
T1E5B5D04AF79348B3D8674B3C03BADB7EDF39AA100365CDD3AB61286085216E1567D3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4620	alg.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1752	fxssvc.exe
1452	elevation_service.exe
4100	elevation_service.exe
4416	maintenanceservice.exe
4528	msdtc.exe
2956	OSE.EXE
4400	PerceptionSimulationService.exe
208	perfhost.exe
4124	locator.exe
1436	SensorDataService.exe
4388	snmptrap.exe
4756	spectrum.exe
4084	ssh-agent.exe
4016	TieringEngineService.exe
4636	AgentService.exe
2588	vds.exe
768	vssvc.exe
648	wbengine.exe
2148	WmiApSrv.exe
4752	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 37 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\vds.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\msiexec.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\807f098f77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\alg.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4196_1344569880\manifest.json	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2336	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0de74d2c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011eea9d2c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d978dd3c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e0f81d3c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084b6f0d1c8eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000863ae4d1c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000c3fd5d1c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec1359d2c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{BCE4F8CC-BB04-4CAB-952A-72EBE2737196}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1176	DiagnosticsHub.StandardCollector.Service.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1176	DiagnosticsHub.StandardCollector.Service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
1452	elevation_service.exe
6864	msedge.exe
6864	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1028	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
Token: SeAuditPrivilege	1752	fxssvc.exe
Token: SeRestorePrivilege	4016	TieringEngineService.exe
Token: SeManageVolumePrivilege	4016	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4636	AgentService.exe
Token: SeBackupPrivilege	768	vssvc.exe
Token: SeRestorePrivilege	768	vssvc.exe
Token: SeAuditPrivilege	768	vssvc.exe
Token: SeBackupPrivilege	648	wbengine.exe
Token: SeRestorePrivilege	648	wbengine.exe
Token: SeSecurityPrivilege	648	wbengine.exe
Token: 33	4752	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4752	SearchIndexer.exe
Token: SeDebugPrivilege	1176	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1452	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4692	4752	SearchIndexer.exe	113
PID 4752 wrote to memory of 1808	4752	SearchIndexer.exe	114
PID 1028 wrote to memory of 4196	1028	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe	115
PID 4196 wrote to memory of 4176	4196	msedge.exe	117
PID 4196 wrote to memory of 2336	4196	msedge.exe	118
PID 4196 wrote to memory of 1672	4196	msedge.exe	119
PID 4196 wrote to memory of 1672	4196	msedge.exe	119
PID 4196 wrote to memory of 1672	4196	msedge.exe	119
PID 4196 wrote to memory of 3576	4196	msedge.exe	120
PID 4196 wrote to memory of 3576	4196	msedge.exe	120
PID 4196 wrote to memory of 5004	4196	msedge.exe	121
PID 4196 wrote to memory of 5004	4196	msedge.exe	121
PID 4196 wrote to memory of 5004	4196	msedge.exe	121
PID 4196 wrote to memory of 1636	4196	msedge.exe	122
PID 4196 wrote to memory of 1636	4196	msedge.exe	122
PID 4196 wrote to memory of 1636	4196	msedge.exe	122
PID 4196 wrote to memory of 3956	4196	msedge.exe	123
PID 4196 wrote to memory of 4612	4196	msedge.exe	124
PID 4196 wrote to memory of 3956	4196	msedge.exe	123
PID 4196 wrote to memory of 3956	4196	msedge.exe	123
PID 4196 wrote to memory of 4612	4196	msedge.exe	124
PID 4196 wrote to memory of 4612	4196	msedge.exe	124
PID 4196 wrote to memory of 5428	4196	msedge.exe	126
PID 4196 wrote to memory of 5428	4196	msedge.exe	126
PID 4196 wrote to memory of 5512	4196	msedge.exe	127
PID 4196 wrote to memory of 5512	4196	msedge.exe	127
PID 4196 wrote to memory of 5752	4196	msedge.exe	129
PID 4196 wrote to memory of 5752	4196	msedge.exe	129
PID 4196 wrote to memory of 5760	4196	msedge.exe	130
PID 4196 wrote to memory of 5760	4196	msedge.exe	130
PID 4196 wrote to memory of 6040	4196	msedge.exe	134
PID 4196 wrote to memory of 5248	4196	msedge.exe	138
PID 4196 wrote to memory of 5248	4196	msedge.exe	138
PID 4196 wrote to memory of 5880	4196	msedge.exe	144
PID 4196 wrote to memory of 5880	4196	msedge.exe	144
PID 4196 wrote to memory of 6004	4196	msedge.exe	143
PID 4196 wrote to memory of 5996	4196	msedge.exe	141
PID 4196 wrote to memory of 6004	4196	msedge.exe	143
PID 4196 wrote to memory of 5996	4196	msedge.exe	141
PID 4196 wrote to memory of 2316	4196	msedge.exe	142
PID 4196 wrote to memory of 2316	4196	msedge.exe	142
PID 4196 wrote to memory of 6536	4196	msedge.exe	150
PID 4196 wrote to memory of 6544	4196	msedge.exe	151
PID 4196 wrote to memory of 6552	4196	msedge.exe	152
PID 4196 wrote to memory of 6688	4196	msedge.exe	153
PID 4196 wrote to memory of 6688	4196	msedge.exe	153
PID 4196 wrote to memory of 6688	4196	msedge.exe	153
PID 4196 wrote to memory of 5160	4196	msedge.exe	156
PID 4196 wrote to memory of 5160	4196	msedge.exe	156
PID 4752 wrote to memory of 6180	4752	SearchIndexer.exe	157
PID 4196 wrote to memory of 4640	4196	msedge.exe	160
PID 4196 wrote to memory of 4640	4196	msedge.exe	160
PID 4196 wrote to memory of 5924	4196	msedge.exe	163
PID 4196 wrote to memory of 5924	4196	msedge.exe	163
PID 4196 wrote to memory of 7136	4196	msedge.exe	164
PID 4196 wrote to memory of 7136	4196	msedge.exe	164
PID 4196 wrote to memory of 6864	4196	msedge.exe	168
PID 4196 wrote to memory of 4612	4196	msedge.exe	169
PID 4196 wrote to memory of 4612	4196	msedge.exe	169

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
"C:\Users\Admin\AppData\Local\Temp\dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://uu.163.com/
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x340,0x7ffb6251c188,0x7ffb6251c194,0x7ffb6251c1a0
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,14266890722867176285,15246750335475738345,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,5893343554946101533,15719864589437037489,262144 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,5053717929283900798,16590114052593411666,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9981819774415473928,14000337495227970572,2097152 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,1457509972372321876,6464384690590514155,2097152 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,149573376785183296,17542134865843089167,2097152 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,6526766518030291213,2157949277086994576,2097152 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15503891415920357682,5258572752708482116,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,10012079299317364352,14970043594706925574,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,17041997058659372108,11078009621234842902,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:5752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,13982826535633795894,1317868789173173126,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5762313615698970212,1081690692687128145,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
    3⤵
    PID:6024
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,5762313615698970212,1081690692687128145,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,5910741333962494881,17444899710939226046,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,15665102744240219680,134765054765842647,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
    3⤵
    PID:5880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6650601542841399140,11854385719640723028,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8962756041874110560,11750685039298264176,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,17775615211815445010,5907362147328282913,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,15402086498924352171,2957827258006346888,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
    3⤵
    PID:6536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,8617381793957407801,13396510063497822582,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
    3⤵
    PID:6544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,11171286168831347324,12661911470605333885,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
    3⤵
    PID:6552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4044,i,15835910732404701269,9223719252267746985,2097152 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:1
    3⤵
    PID:6688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,14644273496920132099,18430000321170967401,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,16951245318443055477,2399689630832023249,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,5168222050679954802,4162921041625310923,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,9389250276662487962,4394147832285628148,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
    3⤵
    PID:7136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6932,i,7121277103120234785,12880046348520089452,262144 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,10621436005165456273,3910516949187611167,524288 --field-trial-handle=2288,i,1675203697007081950,7520158475587551061,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
    3⤵
    PID:4612

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4620

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3476

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:208

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1436

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4388

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4756

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4084

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4016

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4064

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2148

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1808
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-540052884-2969440504-464782435-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-540052884-2969440504-464782435-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6180

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:6004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 594bc6231a2eb2628b9987eb6217a4dff4ed835b9f4fcc3f7255e7e607e13e3a
MD5 45546f4fbc8489119973718272bb217f
SHA1 5cf59c631d76ebbe40ffd01b4ac562b97183e3ab
SHA512 7bea9061a788acfb47fbea89853cd2da9e488b3c72317b9bcbc645240d0c8ac6976000401423c3f3555b755e3528f55ad7f54cb084beb2490f80a3a1c5aafacc
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxn1t7Uv+MnIIC:o3q6sjBSGGMnI
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ba36c047e58e96a9a33d9c3d192426292b455170ebbf52bf590c6cba52605ff6
MD5 37503b3e3a26bf2345a3016fac283e49
SHA1 f138c403843cb5fa5e6973c147a0319f80f1e704
SHA512 429057bb7244abd1e6f6f10c187ba49af724f52d922192ff0419208be1348ebb42d142ff1b0e040a57bb31945f97ad3ae175c0168a5e3d745f45afd597909884
SSDEEP 24576:GXYfDtczA3+Ys7Uv+ahF8MlMPuuICiJSz:ltc7t7Uv+MnIIC
TLSH
T151650128A3D408F9EDA7823CC8B28516E673BC914760E7CB03E495765F236D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6378a2b08ad38c1533db688bf8df4d8bbf27bb6184c0534fa9b1cf8378ecee49
MD5 2d632a7f388cb461f7f3184133c406ff
SHA1 4db36e15199e16ac27980175e574909c39bb2000
SHA512 c92a3f67966238f5a05ce1461359f4919216da0b2ab54f41e50e4589f1a02d09bbb7b2f9151738545aa6549cb72e58645c05cdd22a5f5c85105e03088f991474
SSDEEP 24576:S0Le5ji0hmxxrMg+Ys7Uv+ahF8MlMPuuICiJSG:SPji0Aj4t7Uv+MnIIC
TLSH
T19885AE16F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b7d91f670826e74f0ee2cf7128ad90adc2edadf3b319f0e3f841841687d04c2b
MD5 fb148a6e9b440e149c5b1bacecabe811
SHA1 a7424094edaf0127c80e9b727e1cb12c009f0faf
SHA512 712bcb05ff7363189565f8bb83c496e5f3c35a014394bcecbe4595cf76327ba0418d3e12016f54c0580c1db2ee91f42dbf3899315d206c8abf141eb3515ab46c
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWn6q8wyuS+Ys7Uv+ahF8MlMPuuICiJSx:w/ezSC6vUzPveHjyEt7Uv+MnIIC
TLSH
T19B755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4224be9e7739516e818b324bf7a189937417b3b7bf91b372e02334a5fb4fcb4c
MD5 4a23ef2284824a6197f818772439cb86
SHA1 336b85614defe659bf8065468280a68724265f4b
SHA512 c185e805d455e6c5f35e79ead2c45d45a78c8b39bcf6aadbc7dddb59c3e40748d7ddeaa12f1020c2cc2be8e88013c4e3bd6acb601eb69491f1902e1fe11aac1e
SSDEEP 24576:nVbqPb88hv/l+YL+Ys7Uv+ahF8MlMPuuICiJSs:nVO88hXl+Tt7Uv+MnIIC
TLSH
T1E755AE66F6748331D073C0BAC5D29A9EEE3234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0041d80d3b9920b7f6ce5d4fefe179afb4a31a524d333fe10365ede7496bf190
MD5 b9fb5fa1ec17f157bda9f093372f902f
SHA1 5fae6fb55c390e959d230832624e3bd7f7c09187
SHA512 eec6e29a05ea01f7bf5823b43721e34ec31ad0b1cb21e31d84f882c2ea6989f3ae28f04e88caa21a69a501edf040e09d03d5582aa885b81c6801a2aba8a25d45
SSDEEP 12288:1L5ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Eh:1Lk+Ys7Uv+ahF8MlMPuuICiJS3
TLSH
T1B4452351C70514EAEFE96230B5B9819B61F2BDB4596317C388E07163EEBE893DC63243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1893dcfce3ebdb17e38c8240c57b35d270ee083822b316b807120bcbf197d65c
MD5 1e9f79c6960571b8ce1d2f2c498635af
SHA1 14b2f6817bacea86c8362a06ec0b46717fb421b2
SHA512 60b711d0ea9ac28a643d50bdc2f5f206a5fc41a329ad94a4c784d919c8bd111c302598d8387955a7530e08b4c7744efa63b6947d52192635ac224606519b5420
SSDEEP 12288:beBNUbTVO86Ugep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8El:bJIUT+Ys7Uv+ahF8MlMPuuICiJSX
TLSH
T11465CF3BEE28FCE2C27E9D7856918240A7B278704F62A3CBD174820EDE275E15D76C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6563d32496f9ca5547ac0331296e803c8c3e148ad2a13675c6ba976292436a8d
MD5 32e81c30f04c0048f94924ffeebd3e85
SHA1 5e3fae554b29fb4be2b8598d206447433fbc64db
SHA512 db030af1ad9a3f43c895060e979bdd8216c1d6ec6de0fca6c5644b3e6d49b899c1d696159865b4e3b04465f79ac42525caf916f95cba58931ecf648f41bdae5c
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THS:IQvGAdlCEL8c/DRNw5CbGGMnI
TLSH
T13E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f6d37dcb8bff1babca6d383eef50ed004dae38d9352e274f361204cc08e1e751
MD5 ff1e93528182bb493fb82a94acd5bdf9
SHA1 55dcc5c7f0d60476896869e3df5e72fe2be30556
SHA512 7655ab5a2a0c6d1553c94dc510a53d396fc8fc63dc8117eddeb22dac855f65f79a9a80668cac8592570517bfb8ee5683a777b303427779fb3cd5d1a7544a0684
SSDEEP 12288:EAwSfxL/2Dc3RDLLmt0LDQewsAjWep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8u:Z0ewsAjl+Ys7Uv+ahF8MlMPuuICiJSl
TLSH
T1B475E031FE74E036C7BB0DB21B36C716147D79204B621AC3E3E88A9E99741D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ee96e7801a37a5296d4dc264f576d5dbc92bc0dc41f9f86c26e95ae5448a3c8e
MD5 12d6716f51d21a8601052ae434a2ec52
SHA1 d5890f8355af59bada0fc8745ef85629c677f27e
SHA512 e047d136c707f65864ca88c5b0411825274dabfb1e73a87365f31b592d8f961da3b8626401aac86579027ae3da9e486353613b748c0c4a22bcdf60a2b03eb8cc
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5:dUEtQevvqc2W1cpV2tI325
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d63f649762d96588fcd25c7073777a3105eec5fbfd96016cffce9f1c97c65e1a
MD5 dc3be9766707a10ab825ac2ef40c5da3
SHA1 7ba88321fd320fe84a067dd473e180e628075058
SHA512 3692ee15c580e497a7c5fc385e9b5a6140889dfdaabf1c140636e4e5e908644446477ab7f1c5ae82ec7bcfa51cf7bdb4ff77321331ccbc4aff4dcc137b14350f
SSDEEP 49152:XCbRquA/m2yL5zLfFiV+XenmE3/zIt7Uv+MnIIC:Aoq2VjnmHGGMnI
TLSH
T104D58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f509bad76b311a766704925b56979eb0b903148b056aa6c13a5036b12ba0d59a
MD5 c39efd1d790ec9993ed79f136b714aae
SHA1 54e06002c0378911f7be16b65d7f4dbd865f703a
SHA512 1f73d57001a7bd5dab7c1ecb71b87ad5fc3461270e52fe1b6c1b522444c286d79122e0b73e39983e027856f5cc3f6ab58c14957ee4b6f780f923cde7ef086a58
SSDEEP 24576:uAhGL3IFoiwtA5l7S53O+Ys7Uv+ahF8MlMPuuICiJSG:uAMUFoiq53t7Uv+MnIIC
TLSH
T1AF359D81E7F955D4F5F3AA7899B68171EAB6BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d84d69cb745bcb21621068246d09efa4b0b0346c4c380e763f290e2e4bdb2256
MD5 c6b9965459f22791f7b9e198dcf5f0ae
SHA1 fcbcb1623ae67749fc864a136c3d9474b53bf5e5
SHA512 c81c648360029fe2c2923ce7a84299c246291c4707af652dd540ba0ebe2d6ab9c6ec04b04af81f8dbbe1cb99735086afa2a1ba62b0d4fd7154627a822132f8ec
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+Cbep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EN:Mwu4OWB+Ys7Uv+ahF8MlMPuuICiJSL
TLSH
T14765F14577A40CF9EAA79238C597C136F7F2BC112A21D71F07A0C65B6F37261AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9c1677df147ee6574cfd7ceeac0ab72a2d3659283538d79bf9e3f8a943c3a3aa
MD5 48505848b3a6da4f3b2a816f4263299e
SHA1 813b5613b52fc747de28dc8ab4e00d6d845064ea
SHA512 c4bcebb0e6c2d8d1fc8ee64df29da0555b49635ec190f60fada7df2d0cc21f754c8ac0d966ef227a76fe4baefb9777ca139fe2daaa17cdf35131a4ba637e9a0c
SSDEEP 12288:UeZ1Iymep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Es:tZuI+Ys7Uv+ahF8MlMPuuICiJSy
TLSH
T14F551256639420FAE6E75238D9F5824AE3B27CA2673303CF15A042666F77CD25D36323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 038c9493c8800016dceb46998707eb879f50661bb771b6e5fd76d6dfe2783955
MD5 f671da35d515af4f9ae6f9be5a905adf
SHA1 e8ddd39ee4a1362baa93e2e78559d03d5837a727
SHA512 2e798aa81df12f8523aaaee908c278f5750b2bf1c4a6d10820870f61b3d85a62cfd86401a06bda37839cb692fe6ad75d3901dbce66cb5bedb2ed1e9ac1597b1b
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ue:DQRQyi36YOcPbLvw2gAf+PN3GGGMnI
TLSH
T107667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 56f35c882dd22911115756d2853c22f740d67bee0ff4a0eff35cd65f62f5b740
MD5 ece6e678a1d2d902222e6579cfddcf38
SHA1 6962da411202e8d960558aab1e54ef180e49861e
SHA512 c3f2e297ab981bb48da585faba6d29af4c90bd1088a464b8e3326651bf4a7314c6b63ec89cef194a5c3dc6b4748a6108af36dfc0438bbed0df7c3fd702cda120
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Ue:dQRQyi36YOcPbLvw2gAf+PN3GGGMnI
TLSH
T19B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 52151de597e096e0147f19e089cb49ba5b0624a540869ce6f3537ec0f594e8d0
MD5 8b209073a1efd868976702d807ded833
SHA1 6dcc07970ef99cedf59c6565f35ec54259854fcf
SHA512 df1dbf6d6cc479d8d93f4022bdc4aa993eb973418ba0f0ab57be517ea887612913b602b77830f4dcc92b2e53b63361ef085d21200175a896707f39b6f84c4727
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0Y+Ys7Uv+ahF8Mlr:B68Qg55nhceWu7PNU3/4t7Uv+MnIIC
TLSH
T1CCB55A33B2F200A9C44DE1769F4A872196E17C718FE1E3DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1b1de20dad4d46d371e01662cb35706d1159316b8a74584771c6331a89fcbd8a
MD5 960d75229dd659d2684f5ae5655ab894
SHA1 d9b7c387f3872330fd80c1a694affb4b5c44a5d8
SHA512 1076dbb51d8ecaf789817b095a92fce0e5f4128b78f51732afb27b067212279edb536795f8fc00ed13590ec50c0e29a9a65875417ff8f40b25201e3c45f5a74a
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk998:sy5112gYy5azzVvt69nLKnhZRGGMnI
TLSH
T1D5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d386d4055816cabda372bae92596f08668064caf78b4959a5535a9efd4b2f580
MD5 ea8a5f5eab63ae1d8cd689ba1657de6e
SHA1 0cd4a239651d0ab125df1573c524b63b7b3ffec5
SHA512 138afc6d09950b16e48197488c92c9117a11872e472ae8540fcbea1e0bfc0f02c905becfbe24ff3ddcc276b1e2fabe406d4fe183c037c3317a5f2fdacf0536b8
SSDEEP 49152:DB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glet7Uv+MnIIC:1u6Jmdxd2deGGMnI
TLSH
T1B0D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 28d06515d3800dda84b1fdb44eae506e1dbf718dec3cf5bd6a67fee178c1fb1d
MD5 e483a855c96cd1adb0d61cc1e9475244
SHA1 94a1a8ef45d6732e61e6dc68f4eb9c6445dea4bd
SHA512 73c3f0be8f32249ab8dd7697a7912e57c5a23dc9aa4c44e2ac40d3b43ae0c69a7e46be03ef49586b13d4bebf1ded9ded85dd368a836c2754a251d4127136c9cb
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4x6t7Uv+MnIIC:TmifPWRHGGMnI
TLSH
T1EDB5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 098003cc1782407a8d56700ba3a277b2ceb8620d8125c51b75655c5f7d33d0e7
MD5 26d43df7ce7f0e3f61c8a5b066292568
SHA1 5716b4dcb37f584a2c7c3ac4508189594812f768
SHA512 4b94ee065c0a8664e3131740bdac0f139a77e2c8cfa4641690b840cc44f67c802edb353db35f814317e81efacfcb86787fb1dfa7bbfbbf2dfa06f2b20a395c77
SSDEEP 49152:6SuZQIY0Be2KcRVtOnks6NMHqlt7Uv+MnIIC:k5dKii61lGGMnI
TLSH
T169C5BE13F2E940E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1df6571449e889c26c49822763b443c5cc962e73cc6c7c4a6d6804c9b2b90290
MD5 f6592a514457be48e4c3c647cd91f541
SHA1 b65a38e7a4cffeb008a10a75937aa0c2e2fc8225
SHA512 355203497ec74ce08d33f7e688e0f471ab37820018ef09614e1ee547a8fce607ba4e1c16f179b531c6617ab2d0122963b235dc05fa3299fbe97a12e8d02cdc5d
SSDEEP 49152:EhtSn8EApI0fig3giDn0AP5wOt7Uv+MnIIC:FX2imphDGGMnI
TLSH
T1D095BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7fd8b52ead6dd00368f2a55fbb317ba763df6ec0c5125a76e5207a68c3038d80
MD5 86934104cb3b5891059a27ee49350ac5
SHA1 1764aba4bbf19e6dcfefa4db1df540a88d0d1972
SHA512 42848c104aade6687b0e92fd36715a40188d6efe858aa0f3cd153419990e39a6f300aee5c3a38f0a59b2b083640da5d7419528e3085ef14ebab6081f32598ccf
SSDEEP 12288:Bhep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ep:BM+Ys7Uv+ahF8MlMPuuICiJSL
TLSH
T1C9452351DB0514EEEBD45330A17581DF60F67EA5AA6302C358E46123EFBECA35C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b1c0bfb49f9bba309b7fc1f8d651efd211d39c7e4c37d6f310b66bad6b2d3366
MD5 517faa31d92deb915c9e9ec33f0d0475
SHA1 fe242fc663cddc10570d31cc3a9fd2f22ad095be
SHA512 a56d80f48ddd4ca2d7db5022bd5ec4cd169ba4d0afaecc4e3a4da01951e1da36be47710c5bf18af659762dbfef58b302d9cf7263132fd7dbf8731acaa1ab80ff
SSDEEP 12288:xyep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Eu:x5+Ys7Uv+ahF8MlMPuuICiJS4
TLSH
T104452351DB0514EAEBD46230A17581DF60F67EB5AA6313C358E46023EFBECA35C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 9d0ba5ced596a69c83f6f0f23457e92bcb40a263e7243d3b007df7e1f0980e28
MD5 d32f399fa20f5d01a8efa464e0ea5127
SHA1 614b0372921f271c647bcd94fb02dec5f0a4ab06
SHA512 958a8d9a4d2271a681c8a7a776f09f8d6b953ba1b959d3ae6ef6a6ea0d96a8c74c6fef6e860fb3c20c79cd79275b201985249a0d19252cebfb693349bb001abc
SSDEEP 12288:yoep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EA:yb+Ys7Uv+ahF8MlMPuuICiJSe
TLSH
T10E452351DB0614EEEBD85230A17581DB60F67DB5AA6312C398E46023EFBEC935C236C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 4405f521a3f9aafb94e234f320f756b45281c505a3fbdd5a76ad9f14fdd4eb93
MD5 418a4663896040429e1c0c8452cf826f
SHA1 ac7b81b094cfbb48acc5cefbc88201efbb937631
SHA512 e8d4f67cb5e7e21a65e50c3f2eb2e062963e7cf787db6d4d8b329ac3bd2a0f9d6b81a79569e11fb316879f902f0202699ebbca2b7c4ed80cc00b243384794ef2
SSDEEP 12288:pV/ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Eq:6+Ys7Uv+ahF8MlMPuuICiJSY
TLSH
T1F3452311971500EAEAE5E334D575819BE1F2BDF5A73313CB999010639FBA8D29C33782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 43c121551837fd4e8dbfbe13c30e443ca530a317711d4168f8a2f29f2ee4e313
MD5 50385623619b604ef7176a430001c57f
SHA1 5ac43a69fac18d37bccdaa9d319897cdf4a89118
SHA512 6066d7cea5e5a0e14798655c3e5d02c44ee70889e0c255039864d52f5fc3366c77070f6e71aa954efd7d79d40cf132159e8df1009a2478b6c200b635bc94efbc
SSDEEP 12288:F3ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E2:Fm+Ys7Uv+ahF8MlMPuuICiJSQ
TLSH
T192452351DB0514EEEBD85230A17582DF60F67EB5AA6312C358E46023EFBEC935C236C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 235f70957c01449845d27739efaef1ee0f9734f582306fb455fcb4b313a3116c
MD5 86eeae6da8a63a05830cf20452589104
SHA1 db6f5aae12395ade13656f6b7e07bc28155a9fc9
SHA512 558d36db11d3ee0c8e80b729b843b5139439e91a71a074f98a6c79fadae73f812ed5f924fa95ab1f1a4a50ad37f82842718834858d29299c80062105038f7dc8
SSDEEP 12288:y+ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ew:yN+Ys7Uv+ahF8MlMPuuICiJSq
TLSH
T127452351DB0514EAEBD86230A17581DF60F67EB5AA6303C358E45023EFBECA35C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 19255f90ac838baf4aaf8451736de1a8118e81e469b65504b533044c153bb69c
MD5 df902b00acbc3b9f0a1caa40b9a8ecce
SHA1 f8d341b0ea9352277f6434b470d3e19ad4e6dc95
SHA512 daf34ba049d0b9da9f32285c6405f57d200eee2d33493e56c8e2da043ffc65440d6c57428c829c8fcf61024cfd4b9acd6cfb736a50d1604c5d24f643d918c3bf
SSDEEP 12288:RKep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E8:RR+Ys7Uv+ahF8MlMPuuICiJSG
TLSH
T1A2452351DB0504EAEBD85230A17581DF60F67EB5AA6312C398E45063EFBECA35C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 625d15f8b9e97c2c34ad3b9ed30794f3b2ab4d37fa2d5ad513b6c25ee7ea1796
MD5 6b48fc623854a58c343f70d626f3519d
SHA1 cb75b6fca62aa0dac30de5d7a66c12050ef5ec2d
SHA512 beda16e379f83bf3e9e82d530a998427caa40f4c2fed7886541b75bb058db31982bf11887b8d85bf16506919c57ab578c69063b79d30db957842dd0f40cca3f9
SSDEEP 24576:MZMRzFVSOZ+Ys7Uv+ahF8MlMPuuICiJSb:MZMRzfwt7Uv+MnIIC
TLSH
T1FA650195B35018F8EDA7823EC9658906D2F27C6A0B70C64F03E436675F772A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9ffab6d43f8fcf1019580bdc454e3a4183ea1fcddb34186ade14aadb69e835c4
MD5 e23af71933413468a30de49464a59657
SHA1 cc952374a2dfdc8b8474ec1e9b9a484d30b168df
SHA512 48bc0216c28752b74522f0de7f0065398be8436496069ed8a7306845e948af6f5f66cb37d526575f8ff3be3dd80685b09341e2da2e25ac1abf9dfcd93972d175
SSDEEP 12288:m1ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Et:m4+Ys7Uv+ahF8MlMPuuICiJSz
TLSH
T177452351D70514EEEBD85230A17582DF60F67EE5AA6313C398E45123EFBEC935C23286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 60dec4dae56e4bde1eadbcf095a6f87ef61d392d83b0f677980e9833857df152
MD5 924e15f53df20c8a2f4bf147ef95335a
SHA1 d0b77fb02cf2217edede832d071eff43d40050c7
SHA512 2aa10d2f1e8b34e94bb8dd0758955658522b0cd6ae6d1cfc8c472cdde57012d37212ad1883e985b07a953d2bd4025e760631d9778f4197682af46ef08f3f51af
SSDEEP 24576:ncP4mcvIjkGOxhKP2l71nNKbrh/8KBw+Ys7Uv+ahF8MlMPuuICiJSV:cP4m4IpOO67W8Kbt7Uv+MnIIC
TLSH
T11465BE2DABDC0096D0BA913885658A4AFAB1742A1F3286CB1170933D7F77EE14F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4196_1344569880\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4196_1995691306\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4196_2132642541\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4196_38894127\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5e8eba6023395ea0002ed6694cb8c874a7354191a017f8d9650fbf9cfad5ac70
MD5 436ca2104f2f767f6aa4df9ad0701b79
SHA1 442c93dab216ece29da1df4c12a02c871068c848
SHA512 7913f809bdeb9eabec0f40ff3001f620f3b51ea33de11d6c8e9b25b5485bb581b508328cc3f0b45dd9f54eec53ca2e7a5cae2eea6e029edd48a31f7ab3165d62
SSDEEP 12288:Tbsflep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EU:mI+Ys7Uv+ahF8MlMPuuICiJSa
TLSH
T151550119D28801E8C1AE6235C7668682B3737C6587F293CB56D0F13E1F7A8D19DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7f6a75fca10871027e511e39919c8b628a3a689568804cb196e64f2ae9fc56d6
MD5 1f42b81e825fffb852494af24adb35ee
SHA1 762e40815aeef2e2c9e95273c33052da7c94cca7
SHA512 1f708f9c28c57511b69b5af3f57e9d292b8e881b4f5c453343338a8d7cd205afedceff9c02ae4a57cf857162b63e77e6314c47e0f7d2311891f765bc8306d78a
TLSH
T1947109370BF74062DB61B7B2ACE0C2033471C6C7F927AE66EDE4AA7D1D197918D98009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 85bbc56972e0fe9c9e9e74797cabdadd11d559b7f66475622a5cb515752c891f
MD5 43ecbd6e73a13c4bd4ff9d2b603cffa7
SHA1 ebf2240eb2f50ac0a4c33c7d7accbf7bd8e3ddb3
SHA512 ae355fb4ae3bb788b73cd74eabbb3645873a6b96b521d6c86b737b49ec89de192fac3650576e05175546d5a81bc6c6986ed5f5b7d84df583f61f7c13335fc6d4
TLSH
T1CD7109370FF704A2DB61B7B2ACE0C2033431C6C7F517AE66ADE4AA7D1D187418998009
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bacf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bacf.TMP
Size 3KB
SHA256 a04f1f5147e2762b29717a91ea43e638ba413185df3a0d8d066801b1eb55a160
MD5 22d5da9fbafd985c66def50d8556cba0
SHA1 dead2705354664ac7dc5642b4f588e76ffc79f0b
SHA512 d5dfba30e5ebfda3c480271af38b64c7b4aa860b06e1ac19676c61c0d6445e986859a7c0e8081ec8552b29f7680b04e89a8a920e8ada3e34a560a403866502f1
TLSH
T1B67119370FF700A2DB61B7B1ACE0C2033475C6C7F527AE66ACE4AABD1D287518D98008
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d25bc9d95609d825528ac125c61a0ce6693a8956c4b364ca6e32a844664b3ddb
MD5 6ffbbf44fd09cf0ccfe4493c9382106c
SHA1 56b0ae16b2d059e95b511ac36b373d3a25abb619
SHA512 f00a7b8046128e9e39114bd6bb0b97405fec6aab70b201abb48f52526523c4aa3777029ccc36c0ca49bbed6aec8dad4f587556be1d9da3fb3b31223a76cac315
TLSH
T189519FF783B4866D8A1195F0AA14BF2FCE1D0911436C7C9A85E4AF1BA3F34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4d10b28678bbf70828309b8c8a5b93e6b452d47852529b1c327ddba3c10f8f16
MD5 3f3bb91b5c33c3d6c2a3443a3d30a0d0
SHA1 f34139b81e7e2d7adf432f3051c63433f246031c
SHA512 3c7cb3716263b640846484690c6717b114c7f68a2e606e6e759a41405f66138fbf9446c7df1071fe427dc96c8b526f1b0152aad5a060be6ee04be93ea6227719
SSDEEP 192:sxZJRbyM/jK1Ml8MiK/f+sBmqirhMOQe2Idp4gHW6+WN9tVF/MqIH0rrIg4J:sxZJ/qK/f+sBmqkV3VHb9h/J3c
TLSH
T1D152D816AA345977CCCBD309FA45BB53D7F95462D2840E449AFCCA0C04E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4e65c0a29e9f22167388af826487b3aa9b743168b246ada08727800ac58c74c5
MD5 2453dbe0b7d827cf903dcda51e5dd1a9
SHA1 a0b6ada575b92486dad84dfee0dc9454e89bf896
SHA512 ad7240c20515f73c8b4c679f7a88686c080896248e371fe43157a91fe99db24ff008e787ed490e9b6bc105e66d6dfda7bdd769fa508e4297f29ed763b10f9ca1
SSDEEP 192:sxZpRbyM/jK1Ml8MiK/f+sVsbqirhMOQePIdp4gHW6+WN9tVF/MqIF0rrIg5JJ:sxZpZqK/f+smbqkVgVHb9h/731
TLSH
T1EB52D716AA349977CCDBD319FA45BB53D7F95462D2840E449AFCCB0C05E6AED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 65c8b8e25270a1acc128b1cced4aa037cc7ac6733690df106317f3d19b9a1cb8
MD5 ca0296244bdd4cdb9f84e981c55eefa6
SHA1 2b8088b1c2119fe87247623886d98b106b558e8c
SHA512 6920737028c53fa914d7943fab4449c5cf972a83cc5a2a9cb2c604bf8e8b9b1799a658b049102bb4540c20db497c9e60a937a23ad4f980450b32934c214e6af0
SSDEEP 192:sxZpRbyM/jK1Ml8MiK/f+sVsbqirhMOQePIdp4gHW6+WN9tVF/MqIF0rrIg5JJ:sxZp/qK/f+smbqkVgVHb9h/731
TLSH
T1CD52D716AA349977CCDBD319FA45BB53D7F95462D2840E449AFCCB0C05E6AED2203C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fb736ed12c61ab81290c4f48ea1a55b10bbb15d1842fd40108ef10f97d679e31
MD5 bd765a17ba1e0e60b5025641d07d9bce
SHA1 08dbcb69dca7a1508ec8aec0afc0bc176ec1e152
SHA512 a43b069699fe20b98d196422a24af3e04fc43821c8e8b2b653a742dabbafa8a3478076f6fe293981b8cf28c5f9d0f4f95c7a65d506a433eabb4c304b56ec6c9c
SSDEEP 192:sxZpRbyM/jK1Ml8UQNiK/f+sVsbqirhMOQeOOIdpCgHW6+WN9tVF/MqINx0rrIg1:sxZpZq8K/f+smbqkV+nHb9h/qq31
TLSH
T1D562D716AA349977CCDBD219FA41BB53D7F95472D2840E449AFCCB0C05E6BED220782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 715cce63c8b01de3cd7091ba8259c9013f3a22d89b104d6374b05ffe5ccf2044
MD5 085c1e7290973a05fd4fc243e6e83eaf
SHA1 a51c06565cbb946f5e7eb6c31bc96e5a0c9237d8
SHA512 82d35a0718f874bbc86b285dbd344fa87155ca8eca55947a526469401e4bf59fefce7e5a525822cf6b9072a613f10a579bfb925d9a6bc0331b33b546ef22fef8
SSDEEP 768:D7sqxxa7pLuLXJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTps54Ll6AR9wrq:D7sqxxyEXJlWvJD6Tu1ja2y54LAs9bg+
TLSH
T129F20D3B6D0CCB7E4F844E9CED2ABE8A6ED801CB96D8C95447FA840C03C66EB11165D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ab6a179-39fa-4633-977b-5c92e6fe310d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5ab6a179-39fa-4633-977b-5c92e6fe310d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f1f2d874c886cf88376444a05aa196cc596b10b07278a9612ff460504ab81a0b
MD5 b3026ded311704310377969f9bc91522
SHA1 925c9e09bc4c46b9ea82d9d97daea5bf970b3c38
SHA512 a8d956f865eafeffc40dc333aa3a203a5cdc094c6be72427a1d09439beb1f035243bd635b1b0b61bd5708db8e5e7ef36780489367fd90a2d271761b4768c274d
SSDEEP 384:nItNnNnb9+sNawjLbboV/VRNPOwG9OSg8Vo9dYkPj4+:IjZbEMctHPOwG9pg8sYkPM+
TLSH
T1A7927C326D388C679EE3A616F10737935FB850EBA9852F84D5D85F0D01DB79C230AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 1f8f37815745e9064b42e7d14d61944260e12bf29f38a292124fde926c3a7c4a
MD5 c7122a5b96215b3c95b403327e08db40
SHA1 828d76ab7fc35978db5f9cd583675cd2ca81effb
SHA512 7755eb7f26cde87e6da52ac72364c6e5cf8c65399fb8a74ae6e1164f5d71f6cf5a619e4f35645a5d95a4cd051471932ad5a6fe3f75297e01afe127a4264fb192
SSDEEP 384:nHiF1tNnNnb9kzsNaw8TUNTUlIl0LbboR/ZDfYZRNPOwG9O1g8Vo9dYkPj4+:CF1jZb6GwgewOZHPOwG9Ag8sYkPM+
TLSH
T1D1D2A4F198E78937E9AE4783A33E7E425EBCD093B5885984F7841E0CCC865BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e181cff5ce92bbb28c514b221ba1ae99ef14c44a4672ea1d94c63bcdb8efa87
MD5 c59b4b26ecff84757e01444ef917da47
SHA1 d20546f6248872abf33c05e576f448b764b1bb6c
SHA512 e5e6c51b2301feb9c614f827f5315a4c27de09560b29631126a4bf9cd9239c4354a69a8f96eb381b49c990970626a76d3d708ce487445865cd1316e7c878cb9b
SSDEEP 192:tONY6JkRtQmiUyCyCeW+RNPOmlhPXh3mRmoU6:tONY6UrWW+RNPOwvaU6
TLSH
T1CA02C7356D385C7B9EE3AE09B98727175FA8206BAA956F80DAD81F0C01D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3812a1484a530e970bf1de46bb593a9c74a5d881e053f3fe3dec87172a4af46
MD5 9a0478e285cbe10b430430d72e4f14a3
SHA1 29eef9a34942c141e616b766a72a1d38802a13f9
SHA512 d8cd64acb2cf73592d52771ca8d398f8ecb0f4ba2b772124d7334b441cf4a1edfde9bd13681378f29fd89f12aa2112f32ae8f3d46db6d62d39fe2e2e1e014035
SSDEEP 192:tONuN6JkReQmiUyC0Ced+RNPOmlhPoB9SFkVcX/IgXU6:tONuN6Uaod+RNPOwG9OTg8U6
TLSH
T15112083178388C679EE7A505F98733935EA820B7ED856F80E5D91F0C00D7A9C374AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b3fc77bd4164f30d13c8054549d8d9ddd92026ec145dec665df6b5777437cf28
MD5 898331898327b65b8dd81fdd47c18a1d
SHA1 785569b0c9c6a33c14552591fb224fec3b21001f
SHA512 56bf671c42c0ce3638ac7a49dc3d44b6a4801b79134c274c9fcdebd36e2e9be922464b86768ae594adc5a6e80a4e333ab25c9c4238e742c1f3e8989d321507c5
SSDEEP 384:nWtNnNnb9+sNaw0LbboV/VRNPOwG9OSg8Vo9dYkPj4+:WjZbExctHPOwG9pg8sYkPM+
TLSH
T14B927C3229388C679EE7A616F10737935FB850EBE9852F84D5D85F0D01DB79C230AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

a863beca-d320-43e1-86e3-9e3edeebe28c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a863beca-d320-43e1-86e3-9e3edeebe28c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f45cbc38b97c8041909e672906ca9f6fef508ec60caf558f86c68cd10894e056
MD5 385304628c120f34337e70715c46a624
SHA1 6c06c2562d60224d0e8c6805dddcde957f9a567c
SHA512 edc2027b4fc8718f6c7a8328f29b3f67c48d28e26fd78dea5ba740537b28cc2d2d2ea2d3489a2175a788e3b9980ac81aba2dbd4439ab9c88521601ecf083d817
TLSH
T163412458B6F91158B3B77E5A9BF6686E487B78772F06D45E10100D4F0A26B80CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

a04e9d96-cbe7-4155-a529-e053941dad3a.tmp

Path C:\Users\Admin\AppData\Local\Temp\a04e9d96-cbe7-4155-a529-e053941dad3a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f86d84ff-bcab-4afe-872a-7dc368a1a3d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\f86d84ff-bcab-4afe-872a-7dc368a1a3d1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

08c3e3b7-77fb-4be5-9eb9-1faac5f00e79.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4196_1546589258\08c3e3b7-77fb-4be5-9eb9-1faac5f00e79.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4196_2135222189\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0d15e28db0a3651d4f62237c54fb344935f98e6371b12624e280787f6bf3a86f
MD5 76d4f0f4ec7cee255171b60388394e6d
SHA1 c96b6978054f14b31e2bb0287b74a2f7ffe66c11
SHA512 be02e2a16865d77e61745428a8ee2bfb43d3c289550349237718217ad98908b523bf31d42cb619daa73f6ef3e5c3ace25d152d230a2eeb200e6e9cb8ff6f5bd2
SSDEEP 12288:OFep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Er:Oo+Ys7Uv+ahF8MlMPuuICiJSx
TLSH
T11D452321D74914AAFBF963306175C16A31BB7EB45F6342C3A8906162EE7DCA29C33347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7a4878a84ab66302b1fc6daff0b810e81b817eb98c8bc2d2cf773d2400feb3fc
MD5 879f23a300aee3347e1c7e4a3e7a7591
SHA1 fe76e813cd1238a50ba1de51177d7a9441f798df
SHA512 47e3120d70ba3b65e82246786cb3465d4abe03583866b05705960eb37bfd3bbbad092b1b1c9e115daca6899c2a0a90bd304d724ee63e9263221f379f5f22e5d4
SSDEEP 49152:ja0h2GEkuAe73q3pp46zwwQvt7Uv+MnIIC:ja0hNYG4JwQGGMnI
TLSH
T122859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1190853D7F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a2a51f194da88fbcf3aa82bcf1c6f10960d17ab1dc970f99de4c354f30fc1714
MD5 f9c6fec3cb52f06e987ac3ac38d8d42a
SHA1 59c871e1058c622e5f6fafbddd56f85c0e544575
SHA512 1cf2cb2a4b7b2a86337640cb29b27662c025485803db92dc0805087d9ff371fadf2ad3b1a715bed40b713993c9c89d5bc167907aa615a0bad724e9c679aa9306
SSDEEP 12288:zhbHjfXiep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ef:zhbHjPJ+Ys7Uv+ahF8MlMPuuICiJSZ
TLSH
T10A55127E57AC20D9F6B1A23C95A1814BD371BC65172253DF22D1827A8F3BCE15C36B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 0ce7983015286dbbffdca8eebd86a25f4ade2e5bb4cc138c376a738ca033a2cb
MD5 f4b405a98a79e8920bc9a4fc0d77d867
SHA1 5ec48bd142b69eba2f3deafa929ff634c67db1a2
SHA512 428f3de9ae7b8e03f9b36b942b9ff94201d605b673ecd2ddb42877dd7e9defc3bf0c919620123cdf0c728df5b208a47390682c20fd135f5e248ac57511c74d73
SSDEEP 24576:m3YgnJcRTk4yti+R5dBR/B+Ys7Uv+ahF8MlMPuuICiJSQ:mIgnaTk46pBR/kt7Uv+MnIIC
TLSH
T1F145BF2DF3B910B9D8AAD236450143B5FB71782D1F219AC70170C538AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 cc51e8568e8b083825c85cac5f9fd0f1d2f04de4bb166721405ce60a8a662b5a
MD5 30a334098f34e7682b1347f802b796dd
SHA1 0edcdce3dadf7f013b4ffe57c6ae58a10fa540ba
SHA512 d801ee6bfad02081c9818b1d4720e045073cb9b12929d5f8446b54d97cb0271b71677eba5a2015b8ce90d17c8983438287c2326dfbc8315b0f5602c2c47b5291
SSDEEP 12288:DZep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EX:DE+Ys7Uv+ahF8MlMPuuICiJSR
TLSH
T130452351D70514AAEBE86274A575819B60F27EA05B7313C358E46163EFBECE39C33283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 a3b8ba7feeaea8f2bd1bbbc8922f350f7a4483cf3464b5d720fce988a3d13690
MD5 58be57c2510b2eb0dcbdf5478a13d33e
SHA1 d9c80a5d24779255c23048e66ff467b201dd95b1
SHA512 66a6f277c9b8e61dde8b3cb94663b07bc9a5a1c7bf26e165d3b631bef747bd6ff6209d5f0e7eec6e32b080fc48355e9cf87d246a738120c13a8333969b70ddc1
SSDEEP 12288:cObfA4LWOsvAYFT8ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ec:BbL3UT3+Ys7Uv+ahF8MlMPuuICiJSG
TLSH
T147750255E79400F9E9BBD13CC9B28617E2B2785D0760E7DF03A84A661F236E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 a3b43e8864f1a63a8d26221d6510dc8292d7f6a596c79b308809b79b6c154afc
MD5 f45922ede88e1e89e166798a88a46de7
SHA1 a9c4fe2aec2979b45775db2a0edbeaa0f38faefe
SHA512 24c6024e15d1dcb6b8a27d845266a9c47316c2423e650d0f7b8ebcee9ebb45d30b7e6ba819cd28d1e647890fa38527ca5a88cb939019611b3556f79e66b5edbb
SSDEEP 12288:fpFtIOAep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Eg:iOz+Ys7Uv+ahF8MlMPuuICiJS6
TLSH
T1F2550229379D10E9E5B9A23C89A2834ED3B2BC65072213DF05D0817E5FA7DF46C36B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 66512868e9c293939b349bb45d89a1f27aaa426f9412e29053327c9c71f7ff54
MD5 7527766b93e7cb0ef0372737a272b474
SHA1 0098bb5f91cd5d59ab95c7c959e24677ddd03e84
SHA512 fcc0332a34e74cf07825a5603a69420080dbf61c7e708beaea90b2e126d2b5897fd50b064aaaa113119b58ee5a565550d7343e205e2f9116e0b910cfdd746995
SSDEEP 24576:H7NM9YqZqmWMUkPjZM48Mv6bEhs4+Ys7Uv+ahF8MlMPuuICiJSm:H7cBWMpPjN8DbEh8t7Uv+MnIIC
TLSH
T15765AE2E6BAC81D5D577D13DC9A28246F2F2B4611B318ACB1152833E7F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 7a9dc398ebffa0b972558a556cd30af0149b5dcec26d5e56172d1b7a679f65ed
MD5 9920ad129eca20e8c675049f42f8c4d4
SHA1 133b88e7b01ea1e2064310fe1b6b4f9902dbff90
SHA512 19714bd5858c2d21ae0ddcc2278e85f8dd3f5c4608962dc3b3a9bb651860f43e5fa7b55d0a278d7a2f3d55953963ffcabf6caf3775736126fdd9186c4962656a
SSDEEP 24576:lW6BApg2YuyuNDYTabvcdvNYf8km1K+Ys7Uv+ahF8MlMPuuICiJSk:lF2YuHNETovAvNYf8km1t7Uv+MnIIC
TLSH
T137858E2967ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 42d7bbd67565fd1d1a878109e0c096d2e937cd13e9ba2e85a5050fc6172a1aa5
MD5 31ed5eb9e7719ab33148a74150769459
SHA1 66739547c5b8c3764b3cd73be992986bc6dbf62f
SHA512 bf7eb59cc9cefaa5f7712fd324c56779b402e39cd7b1aa03b74a404e8456a40cb4fabb833eddde3e452f2fea615f5bdb3bb3d7685b024ca2fcf7941214be0493
SSDEEP 24576:BAFs06+OmlfkNXEbTof+Ys7Uv+ahF8MlMPuuICiJSa:WFs060lwXuPt7Uv+MnIIC
TLSH
T1BF65AF2F67AC00D5D07ED17D8A97C91AF2B1746307265ACB0160863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 ff0ee998c2a6e0ff88388792cccc0f4459cac75eb8bc1f96956d7b6e1a1f46a9
MD5 e17742e200c59f7c6c60791e1b82e5f1
SHA1 fa8913a3c311e8fbe903873be1c4e99a673876ea
SHA512 6a2f6fe981591b094accafe3a90a26dc5148a2ebbb0e62e45e88ffeb65e96053b5d7c4cef0a774c3ec9f2a48eda5a4664ad14f9975fa6702f74329af61c8b798
SSDEEP 24576:FJnJ5D3WXG+Ys7Uv+ahF8MlMPuuICiJSk:FJnJ5DGXPt7Uv+MnIIC
TLSH
T11375D02DD2A810F8D4B7C274815A1796FEB2387D2F226AC728B4D5357F12EE09979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 11fc82e4587547289a3d0eb7925e4b11fe75ea0d613497cc510c7270dd4e0611
MD5 d0db95d429a5f994ddfb7b91b72ebd7b
SHA1 14e3e2f60a284e8e9d9712415cfe95194897fd8a
SHA512 3c68451f8a5c54ac69acc40ab7bc249f80367e7ea6428169cba0f90d1d13d2e84d3799a0e720a76f1e20d53fbfd2fd495063717524307c15aad7af4341caf3ba
SSDEEP 24576:3EPghm6/7IIXdwcXrif7qQncjlP65i3VuB+Ys7Uv+ahF8MlMPuuICiJSs:wg06DIKdwc+eQnSt65aVJt7Uv+MnIIC
TLSH
T1A6956C16B7EA5294E8B3CAB1C97291169B327C509B34F7DF0AC0C92E1E33AD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 c42b8ba03f2be4b053deb5ea2b1119025b3e4f6846e14586fafa83bf6346c6e0
MD5 7309cbd1299c54eb5e1b5a824973b758
SHA1 e123125fe706cdc1f82c68266d1fb02b38a6fe5b
SHA512 0ed06a5a8cbf24df15ea419b45ed857e97ffe632b14b2aaa12bcbb3e4730022981098da9c74c135cd43672133e9b2a63c5556c5940ac79116f0f74bac94eb141
SSDEEP 12288:tEP3Rnbep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EU:Ony+Ys7Uv+ahF8MlMPuuICiJSq
TLSH
T17555126D675C20E9D669A13C91A1824AD3B2F4702B2327DF55E0C13E8F7BCE61D3AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 c81f6d9cd7af6e8bcad6fab458c32e229608cee51a0a1a7e6db40903b92299b4
MD5 3e1a85b5ea44150eea388eab7190a980
SHA1 612099b637a17c50e9c8aef5d0db70b01929c345
SHA512 45be45e11ee1cafe5e8f72f60c019d9afa7d5efdc61b9d6507acf95fbb702542c915b726f42d347f93cd44a527cb06e1adaf787c32161f08133a8ebda897063f
SSDEEP 12288:cjkyyep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ew:cIy5+Ys7Uv+ahF8MlMPuuICiJSG
TLSH
T13C551204939860D9EAF95238D972829596B5BC305F2253CF54D0F23FAF7B9D1AC32B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 7630c3dd89d728a3d04f5904585e7bdd666dfdb7ae1e25c639ed53caa0f1198e
MD5 2f8032f16ad1785a5a1b88fce0fbb8fe
SHA1 6f5a6bb8511061fc2112e3c0266b248bebad853a
SHA512 96e9124e10800652eb6110fde30438bf831e5883e2904b8233022df8b892d84b0aa991b8685b87922068ce1f9da8b8f5084bf4bd31934fd3c23b486dcb6abbbb
SSDEEP 12288:gyQep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ed:9j+Ys7Uv+ahF8MlMPuuICiJS3
TLSH
T19C452318971520EEEFE45234A175829B61F27DB46B2312D758E0A172DFBE8D35C33A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 63d6a34373e149ad6142526865316979af68ebde10e0777ba229d2deeb75dc79
MD5 cda502590be9d61addeae4ff10e04e55
SHA1 a30b038362d336365a42278c6e36d91e76ef4123
SHA512 1bf71753162b7d128b3e494d2e8877717cb3c381bb3d78dc3a30ff29afc3feeff8b4f43902efacf1582db9c01ff76d41f5a332e98891daeb225d5b8f5ab3344f
SSDEEP 24576:2Q9MxZKdcz9dw3A+Ys7Uv+ahF8MlMPuuICiJSt:2VKZtt7Uv+MnIIC
TLSH
T1C4558C2DABE9059AE177D23595A240C3A673B4311B31D6CF2448D03D4E7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a888046aade2c3e8180f08bd309c0d960e15379333bdb887a296a99a05505443
MD5 8176ff3b36061d24864c9b603f617b94
SHA1 afd3d890fa7f9f65bb2cc20e8f28ace542069a2f
SHA512 40177a0cc816ae74108d71eeaa2b0e936a01089ea2d9f9fe67c386a7fe4aba905524d762ff3b6787df3c0f7b5d85f022829f3254554e321b44f6d7895bde4dcc
SSDEEP 12288:zyoKo2JRple9pWep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EL:zyocDApl+Ys7Uv+ahF8MlMPuuICiJSx
TLSH
T1B765E01FBB6900E2E1B6823C89858345E7B3B4705B6213CB5591C33E8F679E9BD35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 c71862b67392278bca88a58b8a56b7d99a29da136717145638fd43ca2cbe5f24
MD5 9d0f96044cb4a4c7a8135e4faea65ec3
SHA1 54f233f0b9340f6cbbadd89c0e9588fda9a8489b
SHA512 4f9c8b9b8424c8b9d19069f4b8903ab9065527e49044ac97f8bfa718b8fa4201fdd4b179558f35a4aab9b020394c5fd4c62a472949fdaecd8242deb540a49aa7
SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKot7Uv+MnIIC:70zuNIOGGMnI
TLSH
T1D9A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 314cfdadb77424701bacba5b5ca9cd7512a1e491491bf44fcdecaa9850df4fbc
MD5 1b8427cd625050509d1ff7a2a4cbc430
SHA1 0cf8a6681c56aea1a595059619c1aff461bb7535
SHA512 b9fcae9a2c5ab1594fdc8f91874dc06a89eb248aa7ceb2e9aab63a2c58b0fcf28adb83f783c0d8f6a55e1bd727c200e81dd6bb96381be944fc388b7ba47b49cb
SSDEEP 24576:j1QT7EcpfxR+N5AWAz3ooiYujMqby+Ys7Uv+ahF8MlMPuuICiJSw:+TDxR+N5YzT4jMat7Uv+MnIIC
TLSH
T14855B12EA7F815E9D1BEC5789A23C512FA727821033193CB42A0C17E1F6B9D85E76F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 a9d8e8bacef35a8bb649f06d0e52e8d21748e49ca7ef97c0ce443a056d568286
MD5 a2438ee93f68b62e65f06f388c2de0c5
SHA1 90434744450e512f463cd77441315b884489bcf9
SHA512 09d8f613c3e07c63170d3492b35980ccdfe88d1509517f14c0ba14308e2c069d1bf4dbf3da4c26a7508e3c35514ed816d5bf9cef2e9f8d067502a0180c9dd588
SSDEEP 24576:oTMdOz0FFS+bmSLu+Ys7Uv+ahF8MlMPuuICiJSE:g0K+bmSLHt7Uv+MnIIC
TLSH
T13B75F13EA36D14E5E57AC27CD6538906E6B23871032266DB06D0C17A3F5BEE47D3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 15f0e898534efe220b4cf47e1649f184398ff4083dca28481a8fa722b80f63d4
MD5 8a96b3d15384cdb27724a7b51c7bf0b6
SHA1 99b9fd4e784a47f28d6d1cff1adfda3c92b472ee
SHA512 60a6cce3a8940c16c77042dedb233f9244b88bef0d265c6850731c54fb355c5afbdcd06aa4435ede8d5757a71b5b6bcc1be86128a119a37dfc6e4c95b66efcfa
SSDEEP 12288:E4K8ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8ES:C3+Ys7Uv+ahF8MlMPuuICiJSU
TLSH
T16955121993D830E9F9B5A2349676425A92B1BC71172217EF38E0C17B9F7B8D19C36B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/208-100-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/208-105-0x0000000000860000-0x00000000008C7000-memory.dmp

Download

memory/208-326-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/208-109-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/648-171-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/768-170-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/768-515-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1028-5-0x0000000000400000-0x0000000000646000-memory.dmp

Download

memory/1028-70-0x0000000000400000-0x0000000000646000-memory.dmp

Download

memory/1028-0-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1028-8-0x00000000009C0000-0x0000000000A27000-memory.dmp

Download

memory/1028-395-0x0000000000400000-0x0000000000646000-memory.dmp

Download

memory/1176-25-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/1176-16-0x0000000000660000-0x00000000006C0000-memory.dmp

Download

memory/1176-24-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/1436-451-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1436-114-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1436-356-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1452-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1452-38-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1452-32-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1452-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1752-29-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1752-52-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1808-925-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-913-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-920-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-927-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-928-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-926-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-923-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-924-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-921-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-919-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-917-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-916-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-918-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-915-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-914-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-922-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-903-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-904-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-905-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-906-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-907-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-908-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-909-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-910-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-897-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-898-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-899-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-900-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-902-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-901-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-912-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/1808-911-0x00000224BC240000-0x00000224BC250000-memory.dmp

Download

memory/2148-172-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2148-516-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/2588-169-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2956-79-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2956-85-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2956-232-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2956-78-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4016-174-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4084-168-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4084-499-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/4084-134-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4084-140-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4100-49-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4100-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4100-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4100-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4100-415-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4100-425-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4124-112-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4124-355-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4388-118-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4388-393-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/4400-96-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4400-89-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4400-94-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4400-285-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4416-65-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4416-56-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4416-67-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4416-55-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4416-62-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/4528-71-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4528-211-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/4620-108-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4620-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4636-148-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4752-932-0x000000000DDA0000-0x000000000DDA8000-memory.dmp

Download

memory/4752-930-0x000000000DDA0000-0x000000000DDA1000-memory.dmp

Download

memory/4752-521-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4752-173-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4752-929-0x000000000DDB0000-0x000000000DDB8000-memory.dmp

Download

memory/4752-177-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4752-209-0x0000000009EE0000-0x0000000009EE8000-memory.dmp

Download

memory/4752-193-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4756-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4756-127-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4756-462-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4756-121-0x00000000006E0000-0x0000000000740000-memory.dmp

Download