dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
Size 2.2MB
Sample260527-m678eaet5x
SHA256 dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865
MD5 80a2eaf9c07b89fa04936a62effc804d
SHA1 6571de9cc7d3429b9b063b4ff2ec34b0bdc95b09
SHA512 204b30628955112d8690ff556ff98832c1c803872cdbe43beb89447ed1e3454f8382c31230c148a601c37fd6b11f48aae329a14de556bf10f84fd6a76128b140
SSDEEP 49152:lAyx2bOQYg3sJfJfL1k7mpkb8MnG/wSsPn3Xt7Uv+MnIIC:2BbOQDiJfO7Jb8MnG/wlGGMnI
TLSH
T1E5B5D04AF79348B3D8674B3C03BADB7EDF39AA100365CDD3AB61286085216E1567D3E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2740	alg.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
2068	fxssvc.exe
1392	elevation_service.exe
2760	elevation_service.exe
3228	maintenanceservice.exe
4992	msdtc.exe
1132	OSE.EXE
1832	PerceptionSimulationService.exe
3972	perfhost.exe
272	locator.exe
4964	SensorDataService.exe
5056	snmptrap.exe
4572	spectrum.exe
804	ssh-agent.exe
2124	TieringEngineService.exe
396	AgentService.exe
3692	vds.exe
3436	vssvc.exe
4012	wbengine.exe
5044	WmiApSrv.exe
2688	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\locator.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\spectrum.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\msiexec.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\vssvc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\dllhost.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c26d944e6bf7732a.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1290310421\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1473016628\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_378807314\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_378807314\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_596960607\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1473016628\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_596960607\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_596960607\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4948	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c20c62dac8eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060d92fdac8eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082652ddac8eddc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046d15edac8eddc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080729bd9c8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0bb32dac8eddc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{07D3D3A4-BA1A-441A-8FED-E61057B8CECE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3908	DiagnosticsHub.StandardCollector.Service.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
3908	DiagnosticsHub.StandardCollector.Service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
1392	elevation_service.exe
5796	msedge.exe
5796	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2796	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
Token: SeAuditPrivilege	2068	fxssvc.exe
Token: SeRestorePrivilege	2124	TieringEngineService.exe
Token: SeManageVolumePrivilege	2124	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	396	AgentService.exe
Token: SeBackupPrivilege	3436	vssvc.exe
Token: SeRestorePrivilege	3436	vssvc.exe
Token: SeAuditPrivilege	3436	vssvc.exe
Token: SeBackupPrivilege	4012	wbengine.exe
Token: SeRestorePrivilege	4012	wbengine.exe
Token: SeSecurityPrivilege	4012	wbengine.exe
Token: 33	2688	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2688	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2688	SearchIndexer.exe
Token: SeDebugPrivilege	3908	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	1392	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2988	2688	SearchIndexer.exe	106
PID 2796 wrote to memory of 4704	2796	dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe	107
PID 4704 wrote to memory of 1768	4704	msedge.exe	108
PID 4704 wrote to memory of 4948	4704	msedge.exe	109
PID 4704 wrote to memory of 576	4704	msedge.exe	111
PID 4704 wrote to memory of 576	4704	msedge.exe	111
PID 4704 wrote to memory of 3004	4704	msedge.exe	110
PID 4704 wrote to memory of 3004	4704	msedge.exe	110
PID 4704 wrote to memory of 3004	4704	msedge.exe	110
PID 4704 wrote to memory of 4400	4704	msedge.exe	112
PID 4704 wrote to memory of 4400	4704	msedge.exe	112
PID 4704 wrote to memory of 4400	4704	msedge.exe	112
PID 4704 wrote to memory of 4148	4704	msedge.exe	113
PID 4704 wrote to memory of 4148	4704	msedge.exe	113
PID 4704 wrote to memory of 4148	4704	msedge.exe	113
PID 4704 wrote to memory of 4912	4704	msedge.exe	115
PID 4704 wrote to memory of 1540	4704	msedge.exe	116
PID 4704 wrote to memory of 4912	4704	msedge.exe	115
PID 4704 wrote to memory of 4912	4704	msedge.exe	115
PID 4704 wrote to memory of 844	4704	msedge.exe	117
PID 4704 wrote to memory of 1540	4704	msedge.exe	116
PID 4704 wrote to memory of 1540	4704	msedge.exe	116
PID 4704 wrote to memory of 844	4704	msedge.exe	117
PID 4704 wrote to memory of 844	4704	msedge.exe	117
PID 4704 wrote to memory of 2100	4704	msedge.exe	118
PID 4704 wrote to memory of 2100	4704	msedge.exe	118
PID 4704 wrote to memory of 2100	4704	msedge.exe	118
PID 4704 wrote to memory of 1668	4704	msedge.exe	119
PID 4704 wrote to memory of 1668	4704	msedge.exe	119
PID 4704 wrote to memory of 5540	4704	msedge.exe	121
PID 4704 wrote to memory of 5548	4704	msedge.exe	122
PID 4704 wrote to memory of 5540	4704	msedge.exe	121
PID 4704 wrote to memory of 5548	4704	msedge.exe	122
PID 4704 wrote to memory of 5696	4704	msedge.exe	123
PID 5696 wrote to memory of 5764	5696	msedge.exe	124
PID 4704 wrote to memory of 5828	4704	msedge.exe	126
PID 4704 wrote to memory of 5376	4704	msedge.exe	127
PID 4704 wrote to memory of 5376	4704	msedge.exe	127
PID 4704 wrote to memory of 5632	4704	msedge.exe	128
PID 4704 wrote to memory of 5632	4704	msedge.exe	128
PID 4704 wrote to memory of 5876	4704	msedge.exe	129
PID 4704 wrote to memory of 5876	4704	msedge.exe	129
PID 4704 wrote to memory of 1756	4704	msedge.exe	130
PID 4704 wrote to memory of 1756	4704	msedge.exe	130
PID 4704 wrote to memory of 5312	4704	msedge.exe	131
PID 4704 wrote to memory of 5312	4704	msedge.exe	131
PID 2688 wrote to memory of 5996	2688	SearchIndexer.exe	132
PID 2688 wrote to memory of 896	2688	SearchIndexer.exe	133
PID 4704 wrote to memory of 5716	4704	msedge.exe	134
PID 4704 wrote to memory of 5228	4704	msedge.exe	135
PID 4704 wrote to memory of 5312	4704	msedge.exe	136
PID 4704 wrote to memory of 4052	4704	msedge.exe	137
PID 4704 wrote to memory of 4052	4704	msedge.exe	137
PID 4704 wrote to memory of 4052	4704	msedge.exe	137
PID 4704 wrote to memory of 5324	4704	msedge.exe	138
PID 4704 wrote to memory of 5324	4704	msedge.exe	138
PID 2688 wrote to memory of 3612	2688	SearchIndexer.exe	140
PID 4704 wrote to memory of 2228	4704	msedge.exe	142
PID 4704 wrote to memory of 2228	4704	msedge.exe	142
PID 4704 wrote to memory of 5456	4704	msedge.exe	143
PID 4704 wrote to memory of 5456	4704	msedge.exe	143
PID 4704 wrote to memory of 1120	4704	msedge.exe	144
PID 4704 wrote to memory of 1120	4704	msedge.exe	144
PID 4704 wrote to memory of 5796	4704	msedge.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe
"C:\Users\Admin\AppData\Local\Temp\dcf1157765e97802dd8635bdda14bd6905c51f3f4eeef920ae64eec1512b3865.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://uu.163.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x368,0x7ffd713ec188,0x7ffd713ec194,0x7ffd713ec1a0
    3⤵
    PID:1768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,13709858334068625607,158003440175893434,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1496,i,17708422118955102833,845218369318986322,262144 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,638225082876420817,4121143515702624567,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,16985745114322099096,13587244214651098647,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,1011213683497965890,14666830837464821644,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
    3⤵
    PID:4148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,17528159809505046319,6866123888038923400,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,4847352668808348538,539482138720812213,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
    3⤵
    PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4312,i,2609540179961833363,6427000812101070517,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,679123685102127961,13872260981968309731,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:9
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,4890267866271902481,17762697316336916419,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,1333813188526045437,10157613150284505769,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,868764462950626649,11302338454189269905,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,4827548583580788659,17168598930071444461,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:5764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14950770237983289842,8543956508664674875,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,14950770237983289842,8543956508664674875,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:5828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,8265530075683700940,82688886395005025,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,1140853917699967153,13828752830352155170,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,18357548346112834919,359429130688963638,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,9265490883001507049,13750537508154448767,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
    3⤵
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,9908748076664184935,114886753972042443,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,16456893355979003552,11356133578260892493,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,12121565324573831907,11779781042809990758,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,4226605652998843444,4670039209410601393,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
    3⤵
    PID:5312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4304,i,9220830226378661770,11999620716573268113,2097152 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,17712780584320196778,10884277719810700838,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
    3⤵
    PID:5324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,15623999468337282751,13543633076505264962,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,16276588163668822761,7683907690684116422,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,15344175370517599949,11473600375500914863,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4336,i,10146921094063507853,9945997602065234220,262144 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6440968273454702408,10287349696470247315,524288 --field-trial-handle=2060,i,6752887634084649158,4203006062283522721,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
    3⤵
    PID:5176

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2740

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4128

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3228

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3972

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4964

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5056

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:804

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3436

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2692 2728 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5996
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2888 2688 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:896
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2654269261-3199571979-4291878722-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2654269261-3199571979-4291878722-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cd3fd7dccbcdee2dbd72fb32f9af2670b94614501637ddebf05857e359d25954
MD5 ef0e253dccf2ff6f27e43724c6cda403
SHA1 c2e16e740d0207ce51b59276e861f87928bad54b
SHA512 8fedbd806914f0df98a4654a41aa47563edc15a0daf358a969b3e02ab495090de0bb684b4bd923718a08533deaff11c1838544263c55dbf6cd9a07686e8ffd5b
SSDEEP 49152:+b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnMt7Uv+MnIIC:A3q6sjBnGGMnI
TLSH
T1B8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9853f8b10946ff57f02b4b3113ca105664eb4e2dc33475847ff7ffc8d4599ef1
MD5 5eb0a9175e68d099e87e4729f63a764c
SHA1 6c8f59275c96d851daf359c28772089015c0bce6
SHA512 a2e16de31e16fb96cce58bd4bb528b06a444842f0572561da0280b6d300d8a7568e79e187cc4e05b0b74a514ffb7354da5f3fffd55da56afb5890877452a6d69
SSDEEP 24576:qXYfDtczAi+Ys7Uv+ahF8MlMPuuICiJSy:xtcat7Uv+MnIIC
TLSH
T10E650128A7D408F9EDA7823CC8B28516E673BC914760E7CB03E495265F336D45E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6af9d2f57b93aba0f5a65eaa2d082ff091f112c003a30b611e1b5b98f177ab1a
MD5 1e1ac87c5f46f27f4db5eda8fd16155b
SHA1 8984a798da957b4b9215cb7e6cc4fd4e55626431
SHA512 b5542a3739ac7ba0c5811c77f7028efd099f136200c0c1fedb0ce8dd77a980a2d6ec4901e0b5292406502a3763b5faac69906e5a714c06de7d3e1fdd25ddce5b
SSDEEP 24576:w0Le5ji0hmxxrMB+Ys7Uv+ahF8MlMPuuICiJSZ:wPji0Ajdt7Uv+MnIIC
TLSH
T10D85AE16F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e7b459138fc1bac4260e21e2b159e20536b7073ca36ade305466f9a896970f77
MD5 adde69f63e3d6a5b6c0ec654bf3597d5
SHA1 1d8d162d8d5770f26b231c9123187a9761dc3a40
SHA512 1b348311137da5675dff24296fad05ef6bfdb48589867b1d1fc5e84dbfda846add2281ccbcb1dcd5af6ce992fe42bbf7023af3c32a6aa9277f66b9fbc92c6827
SSDEEP 24576:Ma7/ezSC6vUyD/aqgrvWn6q8wyuD+Ys7Uv+ahF8MlMPuuICiJSS:r/ezSC6vUzPveHjyBt7Uv+MnIIC
TLSH
T1CB755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 948e4bc00f153b6368bf591cd3cd358fc2cc5747b037fd9c53c4310f9cd94fb1
MD5 645f0315c7740201899d9632ff60a774
SHA1 948b1f3ca30f442168076fa578fc1e51c69273a9
SHA512 592d3059745492719917cffade15ce2e7a9c3b3702c43c9143ee8111447c49cf14185069059c6456cc7b19b84eed4e79253b6aa92af415f9c6c79748b1285533
SSDEEP 24576:UVbqPb88hv/l+Y++Ys7Uv+ahF8MlMPuuICiJSN:UVO88hXl+St7Uv+MnIIC
TLSH
T12255AE66F6748331D073C0BAC5D29A9EEE3234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 aa61a77d512862e0d1725ee619370c0ab409a8d8c9ec93dbfb5d8842b27ce9e2
MD5 ad84b843c815a37e4845ee42695133e2
SHA1 1d3a326f73707af5a9c34519d09e4be103999200
SHA512 dd795a5b6d46c8305537abc07e835b2e1aa1136d69b1753695ec34157b200b0d679a7e75a8ad4745e2076fad8842a4273b1eeec2ea1786a7c8936db446b4920b
SSDEEP 12288:6Leep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EV:6Lt+Ys7Uv+ahF8MlMPuuICiJSX
TLSH
T112452351C70514E9FFE96230B5B9819B61F2BEA0596316C388E07163EEBE893DC63347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4a7abb62862611cbad01eb980c32b48e6e7110241b761159d9c39d2252d682a3
MD5 eea23ced85b31a8ba6e4e9b71ae5883a
SHA1 be90efb29fee6a18cbe3689321fca41602676a34
SHA512 f8a372561201b6bdc44bcb67e18f33a1b44bed4ad8267ce025b6d0c89a022960b964ff5986f0f022d475bafed0e2ccbe60459171e071b073d055741bc7d49b59
SSDEEP 12288:BeBNUbTVO86UXep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Es:BJIUG+Ys7Uv+ahF8MlMPuuICiJSC
TLSH
T1C065CF3BEE28FCE2C27E9D7856918240A7B278704F62A3CBD174820EDE275E15D76C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 237fbcee4f0d58abba798c0bfb1ad233f6e345ea458eae9351dc9d603b6941af
MD5 7cfadf5c034949e90d6cc2959904476e
SHA1 cf6e199f330b6ee27a6ea59081bea5819c3532c0
SHA512 fd8bb30f9f146251407a844bad03d497f35c4a49e9be78a00a9480f6f0b298c48671ed9d0b5298d30e746d9d34ad7bfe37ba2785108a8c4ff368f8e72d0825d8
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:UQvGAdlCEL8c/DRNw5C6GGMnI
TLSH
T121266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 9ea4c27dac21981214e33c9849ff3cc41e9279c78c8a5d8eca0be18fa8e8797f
MD5 3864fb76df4d43cf8f94115edca85538
SHA1 9b7f3d509034f8684b704fe8fcec35d25256249d
SHA512 82128f9b7b1204f10788c43d45149e40a00b1da5955ee8b19fe22fbb7ed65c37ccbc38c26c9d7ee084b4edd240429116e6cf9e28f82e85ff75ce26089eb5d80f
SSDEEP 12288:NAwSfxL/2Dc3RDLLmt0LDQewsAjdep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8/:+0ewsAjg+Ys7Uv+ahF8MlMPuuICiJSA
TLSH
T15775E031FE74E036C7BB0DB21B36C716147D79204B621AC3E3E88A9E99741D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d385b18433b705aef5c7dd432e278b0189b17b81c68f018fe376b8f827d0afac
MD5 5771522d4e4479f3b2c14a4f4144536b
SHA1 087a5f38e75ac7fd24f1d2288db96037ceb5b6f6
SHA512 d40791e2b214464f2ff1e714c57428bef9be83d75544d9d6b7db8e1764db943028083c90386f5d7ef85282ab9b5205fffd71c9e2fd5585b19b1c0b50edae9638
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHU:rUEtQevvqc2W1cpV2tI32U
TLSH
T19A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e3680d3fd9e0fd65385c19fa9c537d4102710907021a14629a3f58269262f888
MD5 e5b8633f62340054b50c589e51fcdb94
SHA1 92dd804ecaf062692e9c01a2231b725231576d54
SHA512 96b83a9cfbe81492342ef6a9a709a0960ba2ecfb288c148137befcbf1a8e874afd6eb6dec88b6c884ad5865b6aa1ed106e4dbb098b4a6fa16c7ebbbe37cafe49
SSDEEP 49152:MCbRquA/m2yL5zLfFiV+XenmE3/ztt7Uv+MnIIC:loq2VjnmOGGMnI
TLSH
T100D58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 73821868f8370b463e24067abf6b6a29567a05a3a46c38b40c9f94bfdce742e2
MD5 156efb018745a46dbeb043d630928f5a
SHA1 68a1e8975a507ab60801bceefc4bd5912e0ff9aa
SHA512 a93475a95b52f56467a694e8505fbb4a21efd1ce67f2d7de0f880580bd58b45f4396ad225cddc15efa69de57269fae66689ba61602f8ea12fa7401dae866e083
SSDEEP 24576:+AhGL3IFoiwtA5l7S53X+Ys7Uv+ahF8MlMPuuICiJSO:+AMUFoiq5+t7Uv+MnIIC
TLSH
T13F359D81E7F955D4F5F3AA7899B68171EAB6BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 39c0d530832e1d7a9816a2110953ce29cb7d7e5f18a50a4c8be21686446757dc
MD5 887780dca160d6a849d99fb390ea8c85
SHA1 5bf233e58d4403690caf9b25efba7a1586533979
SHA512 7af5acdfafe8b56d485cf1ea813e79bc41591684c893861b7c13b50e132b7944066e1f5a5c0f6c157316961a1f40b2dcd5ab281835b24842a588821a78e22097
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CQep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E5:Cwu4OW0+Ys7Uv+ahF8MlMPuuICiJS7
TLSH
T13265F14577A40CF9EAA79238C597C136F7F2BC112A21D71F07A0C65B6F37261AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dda9f10be38ec79ec4dd685308d47e70ca611c45d677e6ea532b0f182de0e676
MD5 5783edbfcce2fe184a0111974b9b12b9
SHA1 f6dc813aaff6dbbfa29178a2cc5911a00af551b5
SHA512 c0ade12a395073795661c7cfdee8184dcce40aedd1a95148fd7bf4809e1dd63add8a5a8918c5c6f171d7d76fbc9ec0fc02213e772288e90f31264825439bcb92
SSDEEP 12288:ieZ1Iytep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E9:vZup+Ys7Uv+ahF8MlMPuuICiJSj
TLSH
T1D1551256639420F9E6E75238D9F5824AE3B27CA2673303CF15A04266AF77CD25D36323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f600cce118abb9690ab394f5c55e43ab81d5a5840ce9e5d5e20a0ce95dff172
MD5 09e69aa18b3ee80193a166b2e0090b67
SHA1 aa91f401a44580215066db5994f2e1c8bd02e986
SHA512 c6b6165092c0d74cb8c887109ad60e351db738ff1fce354a096aea2fa2acdf6b2d32155655f27858bc6aa589e8824c793d94113f2e0f2fb4bf564e5b74c959ae
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:DQRQyi36YOcPbLvw2gAf+PN3TGGMnI
TLSH
T147667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c21af417eb27d2b433706d8c2d81aabd2b62f013cb2cf786c03d57cb82ff7243
MD5 652f6c84f5acba0ab6911d43f6400f11
SHA1 b1c0d64c798fff1af7b461e9502b0b6b17bb05c5
SHA512 c7ea5aba16d247f42c12d1f394410a6d1a25a0c2156c34cada0b70ec5dd3bebeae1e1fed004ef08be5577763f01077b3910249def286fbf70672ce2f61129de9
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U9:EQRQyi36YOcPbLvw2gAf+PN3TGGMnI
TLSH
T114667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f17dddf3b04f1aa6726008d92efba3f16f6519a7cc961fafd34286c54d3a150f
MD5 53d50ae4fd5abf9d7c1530e21354aeb4
SHA1 a8e9ea8f4fe9482277af0900b9d8adc934e97988
SHA512 87135620a258493bb4bc523208b5aa376423965b88176c99553898cb90668a290fb871c881fb15cabb97bc6dee0ec863c7f4d487987029fa1f4936eec418a481
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05+Ys7Uv+ahF8MlX:A68Qg55nhceWu7PNU3/dt7Uv+MnIIC
TLSH
T186B55A33B2F200A9C44DE1769F4A872196E17C758FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 84539cf226fa6b02dae4b870f07a7af31fb295f7339af075273914e81c08400c
MD5 49e1cf97334fec88e3c7380058c508c4
SHA1 2af07847f6f7051b8cdddfcf5b629aa309a4676f
SHA512 4b7492ebbf2f73469f33b43b83a4b094caa0e78f7b49164ccd75664a928a9dfa3dbd8e7e910508d74be87102f40c75b8453ddbb906cefe512836c0d6d42292dd
SSDEEP 49152:A3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99b:ty5112gYy5azzVvt69nLKnhZgGGMnI
TLSH
T192167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c052e5bd92224e1161d6c82b818861d350f263220dec405b112ab9cd0698c6b3
MD5 9e00d334cb43c69a0e88dc3117c2409d
SHA1 e8d7fb1b47f381799a51cd019a31a99b039390f4
SHA512 de4e4c1ebfb45a9b63a7154b2a64fe8aeb89978e826e1664cc111d8eccda6b7c9296448cacb158774b599125a7ae6e89a36392dc2c0f842f797c77f7ed9bb243
SSDEEP 49152:lB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glLt7Uv+MnIIC:Lu6Jmdxd2dLGGMnI
TLSH
T1E0D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ef0521d0104a91ca7c59625a6a68301b6a56fdf9761b0d18418c331f2d46b38f
MD5 d1c7b68e3abd6e30ac6ff4ae5c357e75
SHA1 0b992cee97a935fe7f362e021028a6fe9f089ad6
SHA512 5e0dd737691aa44e2f9874e5d1171f2d45a366826ea7a8e5ec83f8e74b4828605b78f0d5e356832e3da62b674e8c4f66135b0ed99bbdac232be64b326261526f
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xvt7Uv+MnIIC:smifPWROGGMnI
TLSH
T18BB5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fbd529d31c395b364a6283e150a307017e62660bc4c623656d8cfda20a7b7168
MD5 2e967eddf05b460a9085d35590c8827b
SHA1 c4f8da0d69b061703b0b1e1623a08e9a360a7eb2
SHA512 1b74d30882e28dafd0f29ffc3f4b3270eaeabd03d1de80eaf3896c950c6c0511c3d57f20ba934b664981dd40c18dd59ede16e399678d5c43680dcf684b5d0135
SSDEEP 49152:uSuZQIY0Be2KcRVtOnks6NMHq8t7Uv+MnIIC:g5dKii618GGMnI
TLSH
T152C5BE13F2E940E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac947af913ac29b90a441d5b238f70be3c79cf514194b84a656814785d0be6c3
MD5 9894a924425230fada0e834001211035
SHA1 aa69e6525ec227aee531fcad480bfbe50dbf18b3
SHA512 dada23b05882031bb3c845eca03bfb86d38ea308fd2c7a240496718e9aff3536bcd9c47cc8c11710d78c11ecbdc0766dd160e66ac72bcfa6995242aa484b401e
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5w7t7Uv+MnIIC:SX2imphCGGMnI
TLSH
T10295BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f85697bc7d7c3e2afd78ee1c7ed090f9f505ee28bb947e01f5aafcc84b24b601
MD5 8c07b8d35f5f4984a38693aabb3402e5
SHA1 27afa797bd9fd0294dc4d4fda48deec61bdaeeb6
SHA512 41dd79655ef06c7c1bbf6f1288eea94396c143581ebe1ef99973bddbf3986dc0ddf4a1bc8d809fe7abf53309f196f306c50df2d297f47b65bb91604fa3762b04
SSDEEP 12288:Umep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EU:UV+Ys7Uv+ahF8MlMPuuICiJS2
TLSH
T1B3452351DB0514EEEBD86370A17582DF60F67EA5AA6302C358E45123EFBEC935C23287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 07993c55d3d9f13d2fc38753cabd65624214bcbb63361382d7de922815f97083
MD5 bf16342ba124f8061044d1f7d817c826
SHA1 93484a2ee03c0d5116cbfa442a8fe0380c00fdb7
SHA512 b612e26750dbade83c8ef3ffdd1439ed17c6e5118e0e79d3a49c4187b87245bef9690e4f5fceea8f44f40b408fed340da8c16cf04a4e97d03aeb07d49d9f7d04
SSDEEP 12288:ZBep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ef:Zs+Ys7Uv+ahF8MlMPuuICiJSZ
TLSH
T19E452351DB0514EEEBD86230A17581DF60F67EA5AA6313C358E45023EFBEC935C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7bc7ad4db8620e394fffa085b9b41b26a40de1ed5815846255ffbfa6ebb2e06b
MD5 22b012c638f623cdba57d3b452c6b154
SHA1 85b5c7ee63af6c56d35c98f99f865658848c01bb
SHA512 d6442b6e051600aad60fa3a745767eb96b4e6a7227f4636e28090aa68cf2548e023a016d41ca79477a192914bdf0a656abf69568129e01e60924c4b193ea721b
SSDEEP 12288:Pfep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Et:PO+Ys7Uv+ahF8MlMPuuICiJST
TLSH
T1D7452351DB0514EEEBD85230A17582DB60F67EE5AA6312C398E45023EFBEC935C632C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 9856dd004a8d74ebdd433b1c8ab161be79ffddecc3d316d77e3d678ff3809360
MD5 b6d05b133ecc97588fc46968f9b945ca
SHA1 b332007792824f50d40d6d9a4e54980617b23669
SHA512 77086b3ca48a425ac1af37cae88446ecb04d29e5b2cf8a130157e7a82ec5079f95e110e118262ec23ab622988d07823a658360d2be0e2ec788b4076694bfb4d5
SSDEEP 12288:uV8ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ey:g+Ys7Uv+ahF8MlMPuuICiJSA
TLSH
T1A4452351971900EAEEE5E334D575819BE1F2BDE1A73313CB999010639FBA8D19C33782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8c64e298f86d1001c52a628526ec68e2d9aee0b84ca8048ae4073903a0284c2a
MD5 b0f32f84bfcbba9f442a1917a896b613
SHA1 fd149b44d4bb8bef7fa09ead0b679439209071da
SHA512 084e9cc8f4504cafaa01f223f26d32eef96dc7ced0e7c089296f1865d0af553385ad8cd47a61034d6e243651a8264d73c4309011bbe29867cf7059dc4574fc59
SSDEEP 12288:wUep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ej:wv+Ys7Uv+ahF8MlMPuuICiJSV
TLSH
T1EC452351DB0514EEEBD85230A17582DF60F67EE5AA6312C398E45023EFBEC935C632C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 9a1078e4d28f059eff21f0c0301cd3d90f3292c0e983c7015cc8fc84c3346a72
MD5 813fef0f2b9acabfa57d4cbcc1e4ec9e
SHA1 2801476ae753ce577d8548f1999e9dc38f4a14e5
SHA512 76248df524e283dcf7a0d59e47e967d37f74fec6f5067815f8b37706cb4a16c719647d2a73f51ea0ec17d2c4feb36d4484341f1f50309226f1263a2e2401c2dd
SSDEEP 24576:/CU3pvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwvAa+Ys7Uv+ahF8MlMPuuICiJSx:/CUZPTY+8Wg2lIL8lrIUJLWw2t7Uv+M
TLSH
T11A65BE1EA3DC089AD4BB81358A518A06FB72782E1B3296CF1160C33D6F67ED55E35F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 6e50a23e0c019fa9264566cf4d626ac19819428a6a4b48f7f70a15bf079bb142
MD5 070a78365fec14f7ca152cc6e1cdaab9
SHA1 06ca3598bb7dfed4a8712fa3f311c5e3785490dc
SHA512 7f05873447fa6368581c1a47308fd143ca43c710cacdbe35934f72b50da45f16c890903630aad3f27584c666ef8a94960de6406d64d5dcdb20026dd58b5555a4
SSDEEP 12288:ebsfCep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Eo:lp+Ys7Uv+ahF8MlMPuuICiJSy
TLSH
T190550119D29801E8C1AE6235C7668682B3737C6587F293CB56D0F13E1F7A8D19DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4970154c03e71372a250182be039e454337be64d232075875a85fe45679e9791
MD5 f5c5af3b32bf2f99864931d9fb64fb42
SHA1 f24e357193c4d16a3e2dd7ccb217f49678a9ab6f
SHA512 e13cff7f429aabbf53f978beb247cb48c5b6dc77f3bd5cc5401dd0008d1b0788c163e99967285b341713f8d21e369c5402e6a1776cbc28df24efbcdd678eba70
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T11EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

39283ae4-7412-481d-a418-7d75d79d0bae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39283ae4-7412-481d-a418-7d75d79d0bae.tmp
Size 36KB
SHA256 8047821825db1bfa8b8332bffc439821cea9082350ec7445083a7d9c07274d82
MD5 ad74706554965e88bcc8936d4db0fcf5
SHA1 6466f990eb7c99309d861af83841a4d8080af4c4
SHA512 6d4b0c36a9ad1e9a1c28c1e8d749a1a69e05d88651846f2e5abe8b9a8db3387976792da458341f6af29011c749f975ddbefa7d1611d8b34edf9b9aa879b0e4f8
SSDEEP 768:pg/Lh8dF24/7pLuLXAkWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3fFxjLlZ:pg/Lh8dF245EXAkWRmAcQ3wu1jaKfFxb
TLSH
T103032D3B690CCB7E4F844E9CEC267E8B6EE801CB9698895447FA854C03C66EF51161DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e1aec3eb00d2fe7b9b97260069073335fbc84fff09ea22b5229c7ff93976d966
MD5 16db5b6861e6568bd77bae3172a6d732
SHA1 f56ed0cb2e0abfd5d13471e42589a9dc00fd58ef
SHA512 e537179c198a8f7246f2f9e49be34316664dff319cf45aa3b3040e563fba7c31b8f8300bee943d67f73415828f54c13085d4a63671da4d6c0d9b2c6429629def
TLSH
T17F711A04054BC597E3213B32B7D25242747087A70E4B9F2352A886F7ED38BE1EEAE5D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d9391b19ba4d1d55f21a2959badf2175416e06f64c2837b06cdedbd3cd716b45
MD5 f708fde48fdf56c2e026231be4c55306
SHA1 f85526cac1b784bedca104b3da15f73988c4eea7
SHA512 5f56567bcb8dcf91b529c187f4eab3ccf5e541152eaf0ad1d30fb00a788c1cd52c08aee9a867b09574560ece5fa2febbf873abd9536113e03fb443ba4f91074d
TLSH
T1B7713C04054BC597E3213B31B7D29142743087A70E9B9F2392A882F7ED38BE1DEAE5C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f671.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f671.TMP
Size 3KB
SHA256 cb86187dd83d508ea5ab0e8aa1371f1f6d0cdf69e30ed21d898bea570c0e06cf
MD5 d8acea9dfc6034dce71016247bf1d85b
SHA1 81d0d0b6f54dbba49dba965aea2eee8c2e198687
SHA512 1603fa66980a76ae92b5300bb4493e34067938cdfcfbb27f699e860ec842939ef376f79cad31e4f8fa4db13c5f205cebc5a5bdad80d627dd83294685af58ea61
TLSH
T14461E714064BC593E3223B71B7D26142747087A70E5B9F6311A885F7ED38BE1EEAE1D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4704_646324495\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4704_646324495\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eec76fa7368073bc429b53a14c1748fc7f47d1f0c549e7fc92deb8c95085414f
MD5 56cf18d2aca85596a0e05fab8aae9867
SHA1 5dccf35a87b93aac1f6a14c5eebf5f641d7115e9
SHA512 04fb943873f0d4563e3a9b5b3154e31aafadab3d7ae84ae325b4a74cb1bc946933dcbcbf578230ebf911946224bc4e81edce637a69ffcd0024e608bea22406ad
TLSH
T1FB51CEF783F4866D8A1195F0AA187E1FCE1D0915436C3C9A85E4AF1BA3F34B1E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b36e13d8737b9bf1cc44b6919a6c8c4ce2b69a4930c13f2fbc2e4553a11b2e19
MD5 7849a4cffc352f3ca2b6147acf0ccd81
SHA1 f1ac84bb4bedf2159f507db738bc044b26dacfba
SHA512 f87c2ce7d3e4da18ce15461899cd274735e9265a60b26f6bc69af3a79e5f9c52e2f1755ed176799b78216af32aa1e780534c6a31d8f1e5e780abf7e1d44b7846
SSDEEP 192:sxZFR2yM/jK1Ml8MND/fDsB+9JiHINIdpvF/W6+WN9t6Q/Md0uBHEfD5vIg4J:sxZFQ1D/fDsB+XOIud/b9H/Xu+c
TLSH
T19952E7126A3459778CDBD319FA15BF53D6F81462D2840E84AAFCCB1C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 55afe06c58b6fd0a49dc71641cbf46c0427b1d105aadcef31203e7e4318e013e
MD5 8c1d3f321dcfe2cae95ea4c0816d9fa5
SHA1 11465c65aec78a0ed64418e35c6a354b30896836
SHA512 a84c3866f2a6c04cd085aeaae7c2e16e235584d0994710dfc02b836450847caa1d5db2e5b37495e7aaa620c35681f2565e8947b95a358b41fd75c4ef2dd0763c
SSDEEP 192:sxZFR2yM/jK1Ml8McD/fDsJ+9JiHINIdpvF/W6+WN9t6Q/Md0uBHffD5vIg5ZJ:sxZFQ0D/fDsJ+XOIud/b9H/Xu31
TLSH
T18952D712AA3459778CDBD319B915BB53D6F81462D2940E84AAFCCB1C05E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d9992937008b918daef0e13b9278b743b1b38ac88199cfeaf7a4608f84ce819d
MD5 d4e59ebca68474deeb79156b14c37499
SHA1 f76c5b1f35bd6956955da3c6281eecba1372bb9a
SHA512 ac8057dc006fe84fe73690843a920fae67210e3d2c8eb2066659ea4a336cd0602c5a77258a7a04af3b4762337ecf80281eca13409824c61cfe4ce5d1dda80706
SSDEEP 192:sxZwR2yM/jK1Ml8McD/fDsJ+8JidINIdpvF/W6+WN9t6Q/Md0uBHHfD5vIg53J:sxZwg0D/fDsJ+uAIud/b9H/XuLn
TLSH
T1AB62C612AA3499778CDBD219B955BF53D7F8146292940E84AAFCCB1C05E6BDD2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 14135bef62891d841a7000cef601f974b04365dad9d8deb48d4788e415749d99
MD5 e11efde544c0d25d97d4bacf1f8ed564
SHA1 365ad42eedde40ab782886192574b9a3e27625e3
SHA512 24cb99de8228a7976d027604dfcf3e06e7f6d1271899db104ae427a97b79e392ab293061bf42935818740df34c02af41654366340c53cf62325331489bbfec38
SSDEEP 192:sxZwR2yM/jK1Ml8UQ6cD/fDsJ+8JiIhINIdp5F/W6+WN9t6Q/Md0uBHhfD5vIg5Z:sxZwgqJD/fDsJ+utIuH/b9H/Xu1n
TLSH
T16D62D612AA3499778CDBD319F955BF53D7F8146292940E84AAFCCB0C05E6BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f28135b1147c52f069be3787cb802c9f125aeb5c7af2d7da2899dc840d4c6a9d
MD5 daea235f549afe9557e3bb6068e73a61
SHA1 4c5b790c169be9b0fc9d37df2778ed3eacf1b378
SHA512 69c8b4629f83238ccbff1a6b80047419f265d85ee7ddb16e236aa3c6eeb13763d277539d3bccd9765c970497f08628b88151e0087b1e4d0c44f4df182d2d9ffc
SSDEEP 48:K08I/KFGsH6IfK3KUny1nIFKgMw8gI/K1+8LyD:K08gKFG66oK3K+un6KgMvgwK1+yg
TLSH
T18CB1115231B703023C7E3458D29587670F8271673214A42B3BB844B6CEA7E260EFDAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59815b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59815b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b204500ca818ce44cb89ee2beae739bfe6abc93f4cdb39f821eaa5cc5f855b2a
MD5 4e8264d6a216d2bfba5a9768b50601a8
SHA1 0e97f653300358827c245ebd536f90c6a7135d79
SHA512 dd297fc38cfc8a43920e2e6d8a4e0f0750b6e3cde29bd79331afeb504927c86b6a1ca2bac365ccd26a84d78df636086f04fbcf71be8130af42fa00f4d38eb514
SSDEEP 384:nmtNnNnb9+8NbLKqnB640HP/8u0FptSD+qgQ2zzVo9dYkPj5d:mjZbEf1HabkDRK/sYkPNd
TLSH
T10B926C3668386C675EE7AA15F0073B536FB811EB99C43F84D9D85F0D01DB79C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f259682992ef489e1d8199d799660191ef1b609ea5d0ee643d8099838fe64c6b
MD5 1fa3cdf38bbea4df3783d31f6615c459
SHA1 df67530bbb207a532c64a4e2428bbe75d650993c
SHA512 01368589b3d4a629a84e3eb5837513f2068bfa230812f84512780db03887972c8a406feffb0da6a5adc958720601e0eaf978168bd606ab16d706ba222e243da3
SSDEEP 384:nYtNnNnb978NbiKqnB640HP/8u0FptSD+qgQ2zzVo9dYkPj5d:YjZb1+1HabkDRK/sYkPNd
TLSH
T1A4927C3268386C675EE7AA11F0073B53AFB811EB99C43F84D9E84F0D01DB79C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 20675502fb201beb3de22c6f62a59e4092b59918d00041ae23c87a93e5b3bd87
MD5 09b4eaaf403204d148adb325510ae347
SHA1 207f7251bb2d8edcfc4c61e9a86e58cb746f4b3f
SHA512 cbe8429a887c741ef6ebd3d199ae9ffa01f6d44df8f43e6b9f661e1421ef57af66d6a87ab2f676f90339c4b57e3902ebcbd3401f6642e504ae4551782a241c56
SSDEEP 384:n9tNnNnb978NbhKqnB640HP/8u0FptSD+qgQ2zzVo9dYkPj5d:9jZb131HabkDRK/sYkPNd
TLSH
T147927C3268346C674EE7AA15F0063B53AFB811EB99C43F84D9E84F0E01DB7DC270A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a89228451c0d059365653cc06217499837000aa93abf1fda0c100e1f38f808c7
MD5 425186f48fcead0a1d7347eba88235a2
SHA1 c6cd6e8033f9d91ce3653e5456e2c639d24a0b59
SHA512 28f8b21a2a07b241c117939665b7eca92ae7c235fff67520f403577d026a8520540166060ed15a87e86d35ff7ea340ea056c7e25810537fe41407b1f04029d3f
SSDEEP 192:qGN56d9402QmiUyjvCTBF2oP1SD+oGwQZqU6:qGN56740SAKTBFptSD+uVU6
TLSH
T17D02E8366C782C7B8EA36E45F4473B176FD5216BEA846B84D9E81B0C41DB38C2306977
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a4e0461fb73e763123ceae1349f1ba99c6ebc76ffd682c7a25ee200e39fca14
MD5 51c37c26bc3381fc1041f853f6eb82cd
SHA1 5cb74e84267ee673fb8fe9baef761bd78a406b0e
SHA512 837628534ff875e020b003e88dce24985f44db0efa1b527c1268e9bca60eb08e023ba322d4894c12023136b7cabc3d1b5749fd53a8fb6456c7473303f346b700
SSDEEP 192:qGNG6d940mQmiUy6CHBF2oP1SD+qg7YkyUiDzn/5g+U6:qGNG6740CyHBFptSD+qgQNzzU6
TLSH
T10A1209366838AC775EE3A915F4833B636ED52177DE886F44E5E80B0C04DB78C270B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 b94199bfccfdc4040c8099e18498a4d34ea6e0eb04642602062f58c8367798be
MD5 eab8039dff6bed4c2d11a60bd4ab7ab1
SHA1 bf5ed55fccd72dcc153354bfa7f4b1345318e39a
SHA512 d2b533c23545c840bb803769c540d7e6811d7b1546fb7f30f95ae3374013679fb019632be0ae41e0fa84dd12403f07f1491226181628ca01e61ed00e1e9c9c51
SSDEEP 384:nsiFJtNnNnb9g8Nl8TUNTUlIlhKqnB640HPj8uBDf0QFptSD+qgQRzzVo9dYkPjT:XFJjZbyAwg61b4QbkDRF/sYkPNd
TLSH
T12CD295F698E79937D9AE4743A33E3E429ABCC19775885984B7C41D0CCC872BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

ada392e4-c0b6-4f72-8ff5-34392b5758a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ada392e4-c0b6-4f72-8ff5-34392b5758a9.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

c1a7354d-6e02-47cb-8d04-b65bebd7a49a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c1a7354d-6e02-47cb-8d04-b65bebd7a49a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

05d3f7cc-ada3-40c5-ae32-f674ad0db66d.tmp

Path C:\Users\Admin\AppData\Local\Temp\05d3f7cc-ada3-40c5-ae32-f674ad0db66d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8ceb240f-2df6-4763-88a7-fae7b4152468.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ceb240f-2df6-4763-88a7-fae7b4152468.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4704_1019383371\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

540dd12e-8c8e-4e17-9ff2-a12c1bd24148.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4704_1717117356\540dd12e-8c8e-4e17-9ff2-a12c1bd24148.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 94cdb9206f5e188f42fb9f75716f9581bacda86bd13fbba38b83c632b82bc1cc
MD5 fef37c79da7de9fda304faa93685c2f9
SHA1 3149e8f53dfda078165246429e9c4393bd6e1e03
SHA512 b49634e59d9a40d76d6906dbb48fb82cb07ab5f4d9b57f90dc511d9409a049bafa0e69acefe2f1606125ecf7940c956167c98f30e34cc2d4bdb2f3a988d6b2a6
SSDEEP 12288:F/ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EE:Fu+Ys7Uv+ahF8MlMPuuICiJSS
TLSH
T1A1452361D70914AAFBF963306179C17A21BABEB45F2342C3A8905162EE7DCD29C33747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 b3369cdc142df2fcf828f3b1e140dfd9eeaa744154c994c63022dfd03149f8ec
MD5 e907ee85723eacd3712e0879b9994529
SHA1 788fc9a100e53523fb3b2475c420b07f959bc8a9
SHA512 958ff0e53c59cd48d5df5223eb344ddd87f3de5e8a8f8477ba34a183ee6161fd5ded499de652624519c5e675e742c2ce37f3cba2eeacbda2c6ccfb40f94374ea
SSDEEP 24576:08RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCA+Ys7Uv+ahF8MlMPuuICiJSk:9RZwQCyiHiQEaaPnMEt7Uv+MnIIC
TLSH
T1CC85AF1E63DC46A5E0BAD278CDA74407E6B27816573197CF0190C27E1F2BDE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b4dfd0b4541bc1e5b731efe320d6e67b518cee417acb59d41c1e80087629aa16
MD5 a039d9cfb687963aee61419cf56ea8eb
SHA1 5da732973086332c06fad2453a3253356d26854c
SHA512 47e8e1458846214efca4becf8a8aaa0a773d6beba0b4887565b1d171306ca56d8a4e1b0302622e8bb41bf42ec35aa65e185a4a86ba2b4e811753f625b020a723
SSDEEP 12288:2bxA1U7KPep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E1:2bxA1UGe+Ys7Uv+ahF8MlMPuuICiJSb
TLSH
T11D55122E979C24F5F6B5A23999E5810AD372BC66173253DF10D0827A5F3BCE15C32B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 9f182b2710ab06851ec547765ce07b7328fb8e16c5bc2f83272b91fb3bfd5149
MD5 d4f0cdb94c62bdd297acc0833db6abf8
SHA1 3e9e7be9e5979dd3864bef9a89e4644ae88a75ff
SHA512 a4d5d1a1144e554cd6f36af7cc868219e1d3bdab3f23079573177e09f79124ce2dc8547e161de71fe0262e7114bca92e75285c148518a94af92515576895a429
SSDEEP 24576:SjsmP0yHaqrVqHra44KDzMsrnn+Ys7Uv+ahF8MlMPuuICiJSB:SjRP0yHfVqzlAsrn+t7Uv+MnIIC
TLSH
T18945AF2EF2B910F9D4EAD136454107B5BB71B82D1F219AC70170C235AF0AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 a2056a207e02232594a101203df0f72d10ac0c07d7067d99bafa1b0b84ce74c7
MD5 ae76a5695d3185f1d6afd41470520cc2
SHA1 87c66a6936ca81771495a0d52e6008afe033f629
SHA512 80feeffe96fbe0a6d827bbdd36d7dacf5f873b0b027cbde8fdda42e62f497bb5edba161e569f67dbfdce879910ec369f44d339424488ef866c22cf5dcff75c93
SSDEEP 12288:PFep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ex:Po+Ys7Uv+ahF8MlMPuuICiJSv
TLSH
T1BB452351D70514EAEBE86234A175819B60F67EA55B7313C358E06163EFBECE39C33282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 b0488f7975f43a95e8760537f49f969dc87d99b3c40638e07a8285a6bbeb16d3
MD5 c8dbacc441b136ecb5ff78a1a36bc418
SHA1 cb6a69ed1bb6fc97c5a3e723109b459e8a798c00
SHA512 db5e2e7d3cabb9c9d59deccb8f65eab22b9ee0d3c7b91c22c638d634008da089fa1062c15069e3d70454e3ed4cf23a052a5729d3994836f35558f61b2a6ce359
SSDEEP 12288:kObfA4LWO+vAYFTrep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8EC:JbLBUTi+Ys7Uv+ahF8MlMPuuICiJSA
TLSH
T173750255E79400F9E9BBD13CC9728617E2B2B85D0760E7DF03A84A661F236E24E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 aeb1b3a48030cb9c4421ac17011b8f3308e48cc073e9ef019fe09d26765f5222
MD5 b6fbacec332cea7c20159f30bc01ce93
SHA1 b58956d68784b861f1a685fc9eff6ea7b53844f0
SHA512 7ce2ef1a9c8ce9cec6c43452e67d54dea99755e4ce3489d8ccbc379be6d210d6fbfd77f0c898177f91106a6ea5fd51f344c423f32b29d4999f192098c9a00e11
SSDEEP 12288:W70Vm9IYNvUyBpWep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Ed:HpYNH7+Ys7Uv+ahF8MlMPuuICiJSr
TLSH
T17165F12E926D18E5E67BA17DCAD28209F2737866171193CF04F0827A1F17DE9BC3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b4eeac243e32b1f91f7c54a94fdc69d976b7ee7abfd1ecb20b8e57f97b151d83
MD5 dd0c5c9f849a98b4369b5f64b4553053
SHA1 59aa160ebd34ae847d9aab8a93694f336bf77ea5
SHA512 74d5087ba17767c2fc3d721420c47e020546b7afc08cfa5d015f9b788ccf8c21ab110ad3b3c7cff006273cd951267167cc4d71243cf2b7a9f63de02cc5b06bf8
SSDEEP 24576:XnXoJjNYH84VVSNAApoEmP66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKY:XnXoJJYH84VVS6AmEOJas+cHBjSSKHP3
TLSH
T18665BFAEA2BC04E8D5BBD17DC5C24506F5B278621331C6CF026182BA7F27AF55E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3e96051719ad100e64d151c135a74f512c25e63b83d68f7b858883d9372fcf0e
MD5 b2272f4b32fb3d7c3c8ec8b3fdce9538
SHA1 c3fc9a0df5d6ccefc65b839b3caa9a0c94dae939
SHA512 154974606fcf954fb8c2c51a6c18dff84445de3ab7a6122be44f7be5b9e87e4f1ceac988420e95e224dec9c9edaf64ea272e9ded273d7a7f5c29c57bd24d7ae9
SSDEEP 24576:Av7Xbxd9Tuycf8M/TYlSuxwr2PCN+Ys7Uv+ahF8MlMPuuICiJSp:ADLL9TuJ0M/TYW2Plt7Uv+MnIIC
TLSH
T10B858C5EA2EC42D8E4BBD6BD85B79146FAB2B855173081CF0290856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 bd810904b27c74fbcef1d92ff282350a96faa0f0afb7bd73919ee8316147f60d
MD5 ea3c748a8032879def73e046a19a73d2
SHA1 826458e7e3897e1848df5cb9b5c5cc2b56d376eb
SHA512 b622366058ca8f2e2de4dd6fa5ded40aaade71ba85097044885be5f585b269e5cd9368681d8b592f07e24561c60779611d221be42b91b7b0261dfd46a0c36135
SSDEEP 24576:6egJgpwJOmPOHWAKk8ZguIGyPsxr5Vin10wi+Ys7Uv+ahF8MlMPuuICiJSx:6ngOJOmPOHz7t7Uv+MnIIC
TLSH
T1EB55CF3FA7BC15D5E07EC17D8A928916F6B1782603355ACF05A0827E5F1BDE42E3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 97b8def9ba7d32488940c851a917f070324b94e4df8c88f440d6634cc6a8fd0e
MD5 0326251c408c60a884b3c1009a23cc0f
SHA1 79bd8657844c6dfe3c13f9804710903c1b81826b
SHA512 06e51d2bc37c7841d00ba887edbe9d06063219a54b3f6a3d4e14e0564942ba35cc9cd11dc49639bf0c728eae0993fde62fea8041eb25eb0930db852a99bdb791
SSDEEP 24576:mLJnJiTk3R3waE4JrOI+Ys7Uv+ahF8MlMPuuICiJSt:mLJnJK8R304lOt7Uv+MnIIC
TLSH
T1AF75D13CD2A810E8D4B7C2B4815A1756FF71387C2B2269CB59B4D5313F12EE0AA79F49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 42c94cc655eb9e4814b672dd6b9dd7859a30068df7a299ee7d6e776417c41516
MD5 ba5669f013b76ac1787868901547f2b7
SHA1 f7052a04c3f3b846ac2e5a81c53b472a515a9505
SHA512 d52aef63d0146efe297f8ff14516d803717b95a21ddd750d8f359c1b85614e7fe5e95f43744cb0c8e6b3de2b8a2954a1528bb67a907c7f6bee6a3fc2ba83385f
SSDEEP 49152:69GqCzDScAZmlvTcFg8Ph6xt7Uv+MnIIC:0SGGMnI
TLSH
T163955D05F7EB5298E8B3CAF1C96294169B327C509B34F7DF0A80C96A1E32BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 58f7fe30830c8431c6d824b6f98ee7f8cb50d5dae183b4acbc750a1225e1a2b1
MD5 fa7bf3e277276e79ad3139539a7663a8
SHA1 150dd16a3475a2d73b36989f31488b9f4168ace8
SHA512 61913a12b4ece08878286beb9c400eb1efcaf7a0162f703ab670345ac71851f72de6667ec18512a1ea75437f4aff234f9c8479689a1a4e9feb1003d8336b1c28
SSDEEP 24576:WlYJeXm5jUuES+Ys7Uv+ahF8MlMPuuICiJSf:WlYJeXmRUuErt7Uv+MnIIC
TLSH
T19A55125DB75C30F5E2AE913995A18659E3B2F4B1171213EF40E0C17A8F6BCE22D36B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 25a95c585ac36ccb6c2ac9ba96161b3edb59640345c6c7ac2ed0e01db7dac734
MD5 8abe161e9ecc595038dfa983e892d247
SHA1 5e97ac018376cc1769671d4f27bac5aa4b220c52
SHA512 039c4df307669b6305a88aa9d0215bb97a552a0aa19e0e1a7630c45035f87fd7174c0b0b33ea27527dfd39d01d69357920c2be6fc508558623cde9ee3e802531
SSDEEP 12288:1wu6kysep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E3:1VtyH+Ys7Uv+ahF8MlMPuuICiJSF
TLSH
T1D4551314A39420E8EBF95238DA7381959675BC705F2243DF54E0E23FAF7A9D1AC31B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 71015fecb3d1082b3dfbaff8b4f99807f5c08c03a8013caa890012e3c055c1b7
MD5 ccc469f89ff2d4cdf1fc25365a2f6fba
SHA1 263ec54ce9b73fb77218254b9a66d0cd205fb6c9
SHA512 7d7394369f80b9b902425c5cd08e5f8e02313683f36a6f1f365a27b4662398e35076c6375335f734c4ab25342c3c8ed5a3803bb4748def009a84defe4237e19e
SSDEEP 12288:9Prep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8ET:hi+Ys7Uv+ahF8MlMPuuICiJSx
TLSH
T14A452364971520E9EFE46234A175829B60F67EB05B2312D754E0E173DFBE8D39C33A82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1c80caac1adab6fbcca4ba11eb7488f84be6e6b5830a01a3a5a54f30d36f400d
MD5 0d0dae419e7d171f1aed4b6d8e12ea3a
SHA1 4a451ae96f47a6f7f537fc8fa7061e6944ba792d
SHA512 87dc8f4bf7ca8302bdbfa3072f5db36b720dfe5103143b1e82672a01093554a85222ec52c48ff3d9b6b11a3463fea6adf0d848d75baf58e06f9505d1c636bd37
SSDEEP 24576:sC+TyQIu93VAumZr7jmJ+Ys7Uv+ahF8MlMPuuICiJSY:s/TfIq+Yct7Uv+MnIIC
TLSH
T150558D1DA7E91DCAE2B6C675C8A34493E533B872137186CF2044C07D499EEE9AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 54da1e62377d7e40f7605c5baa9edbbf341005e2d25e96bc6ac11775f82e3c1f
MD5 1fb0a02b17e34ed928c4ee1b61b5d8f1
SHA1 0574e15a498482c3a14432728111794d173eb0ee
SHA512 abf6bdb2fbec1c7a3ead3b1008c714dcbfeb21f91e878c12da0b0489e19ead5d8e56964377eaca64c1a263977b27938d2af3a5ed9c66878fc921823754924454
SSDEEP 12288:gcyrWOstaa3kcsHep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E7:1LQikZW+Ys7Uv+ahF8MlMPuuICiJSV
TLSH
T10A65F10FB36A00A5E5ABC23C88954156F6B37470572263DF45E0C77A4FAB4E6BD38B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1effeb54096d2fcb7fc9ed16e4f920b3fed94cf5293399500c27b3940df63b76
MD5 d95e9dd567b46526b09793cf7eb9c65f
SHA1 ad613a8e03b2e485c0109d899437b3765c4d326f
SHA512 7911082db74e0400686c69c83a0cdd2d94d287a175c9962fb56b5d437e96aea6818f69cb74f54a48814241fc0b7b563cdb0a05beab0c8edca41de875891e2ed4
SSDEEP 49152:5pJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAPet7Uv+MnIR:KpC7b4+80GTkZGGMnI
TLSH
T142A57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB00B0C578BF1AEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1290310421\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1473016628\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_378807314\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_596960607\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0ff9b28d593e0e07d21d86cad14d1ddb1d94e030be766a1b5388413bfca1d3b0
MD5 a2e06383c0269a0424dceef48492640f
SHA1 ddb482f105d6af2e3e0edab7e7910a1626284ee1
SHA512 8bb9b03459c7641426e40b4cdd7b5d0313674ff8ed7d05178ededac987697ea92e9b0d667ffb484b4bbaf409f206f5dcb41e9e500195cb983d9c20947939fcdf
SSDEEP 24576:8SAwJPE1IDAo+4Kt+l4413JUQP+Ys7Uv+ahF8MlMPuuICiJSS:8qPCIo4Kol4vQWt7Uv+MnIIC
TLSH
T16D55B02AA7F956E5E1BAC774D663C601FB727822133163CF5290813E0F169E85E3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 a6fa8aff2efeacb0e7b89444458d833a270fcc5a1d9aef0043e7345f6564ea3e
MD5 e8dd758a6ae95093c7434afccb89c6f5
SHA1 c669588ed939f6fb315b445ed4d77252c72afc8c
SHA512 6bd292c19c23a8eea5b92e1b7919ab8cd0c52a0a66ff0f62aed9d0daacd5c75314eadd4cd17062d2bb52f1b754abbb11e932935c43394a9632a1b54528393c57
SSDEEP 24576:YyLXPLcw94t/+Ys7Uv+ahF8MlMPuuICiJSk:Yy7PoXtGt7Uv+MnIIC
TLSH
T1B975E03ED76D04E5E57AC27CD6A38506F67238AD033166CB19E090761F6BEF4693AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 a330d0447992d2961b115d9ec33bd433541417e4f2ec34e15fc67245c32262f0
MD5 c71dac44b4f96c8b6b61b42821615cc7
SHA1 373a61918a566d87815358eb3c66b636a35a2cfd
SHA512 60d98da7a2091bb4edabcb332ccf0905ae14f3f23554893f4acb8207349322d6ee3309939b7e5064459c44e5e63043a4f6e4ccffd43d4e981f2062f39b58e802
SSDEEP 12288:D9lyvj3IkxjbBz3ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8Es:DWv8qjpm+Ys7Uv+ahF8MlMPuuICiJS2
TLSH
T1A565125E979424E8F5B94230E532816A90B2BCB217765AEF74D4D1778F3A8C1D83BF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/272-115-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/396-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/396-155-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/804-140-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/804-134-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/804-144-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1132-82-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1132-81-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1132-74-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1132-156-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1392-119-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1392-39-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1392-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1392-33-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1832-86-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/1832-87-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1832-93-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1832-161-0x0000000140000000-0x0000000140209000-memory.dmp

Download

memory/2068-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2068-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/2124-148-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2124-355-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2688-222-0x000000000A5A0000-0x000000000A5A8000-memory.dmp

Download

memory/2688-171-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2688-206-0x0000000001F60000-0x0000000001F70000-memory.dmp

Download

memory/2688-177-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/2688-181-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2688-524-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2688-190-0x0000000001CB0000-0x0000000001CC0000-memory.dmp

Download

memory/2740-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2740-105-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2760-444-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2760-43-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2760-432-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2760-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2760-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/2760-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2796-424-0x0000000000400000-0x0000000000646000-memory.dmp

Download

memory/2796-80-0x0000000000400000-0x0000000000646000-memory.dmp

Download

memory/2796-8-0x0000000000BC0000-0x0000000000C27000-memory.dmp

Download

memory/2796-1-0x0000000000BC0000-0x0000000000C27000-memory.dmp

Download

memory/2796-0-0x0000000000400000-0x0000000000646000-memory.dmp

Download

memory/3228-64-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3228-55-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3228-61-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3228-67-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3228-72-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3436-160-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3436-380-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3692-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3692-159-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3908-26-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3908-25-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3908-17-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/3972-102-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/3972-165-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3972-97-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/3972-106-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4012-166-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4012-439-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4572-130-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4572-122-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4572-128-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4572-307-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4964-180-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4964-116-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4964-370-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/4992-69-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/4992-151-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/5044-167-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5044-469-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/5056-224-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5056-120-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/5996-959-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-950-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-949-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-948-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-947-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-946-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-942-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-940-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-939-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-952-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-970-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-971-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-972-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-973-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-975-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-974-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-976-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-953-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-954-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-955-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-956-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-936-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-957-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-958-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-960-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-961-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-951-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-943-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-945-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-944-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-941-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-938-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-937-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-934-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-935-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-933-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-932-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-931-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download

memory/5996-930-0x000001CCB79D0000-0x000001CCB79E0000-memory.dmp

Download