0b52da2d29acf7228710e882bcb0237498214b11387df2f9be84bc5a0091fb32

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
Size 3.5MB
Sample260720-tb4easfs8r
SHA256 0b52da2d29acf7228710e882bcb0237498214b11387df2f9be84bc5a0091fb32
MD5 6aeba1c6e90cdcd9cbab339dd8e13144
SHA1 198eff65efd2d724bc525bd6300b503ea9ba94f0
SHA512 083d362125b1f276f6d7fa33eb94e0e38a10f20f15c92ff31284f1696b08f2c2e8e8f3e94068a0bd82790ef174826c063d9946ed4dc4454a4fd56551f1ee15c1
SSDEEP 49152:5oUHlGVwASOcGtlq0wIU6i61VrVLm98bQFv9bE6xYCOjA8KbQpshFdPzryZdHJ8t:5oU4P+3x18KbQ8dryfHUWeZE9
TLSH
T19806AE16B29400FDE8B7C07485464133E6B1BC9A6BB0ABDB01A5BA391F77AF45F39704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2512	elevation_service.exe
3100	elevation_service.exe
4144	maintenanceservice.exe
5616	OSE.EXE
720	PerceptionSimulationService.exe
5604	perfhost.exe
4240	ReFsDedupSvc.exe
5668	SensorDataService.exe
2408	ssh-agent.exe
2680	AgentService.exe
5592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
4132	verclsid.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2778f2b683806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1156120453\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1156120453\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1053035142\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_770515241\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_770515241\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1053035142\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1053035142\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1053035142\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1456_1276329271\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4444	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0cfa7076018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc1add446018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dce80f456018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001a120096018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba003c066018dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290364627485024"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000070c478086018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ac5ec446018dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{D0715CD4-0C33-4E6C-AB4B-1330ABB4F345}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
2512	elevation_service.exe
5616	OSE.EXE
5616	OSE.EXE
5616	OSE.EXE
5616	OSE.EXE
5616	OSE.EXE
5616	OSE.EXE
5616	OSE.EXE
2756	msedge.exe
2756	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4080	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2680	AgentService.exe
Token: 33	5592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeBackupPrivilege	4240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4240	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4240	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4240	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2512	elevation_service.exe
Token: SeDebugPrivilege	5616	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1456	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 4584	5592	SearchIndexer.exe	100
PID 4080 wrote to memory of 1456	4080	2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe	101
PID 1456 wrote to memory of 2728	1456	msedge.exe	102
PID 1456 wrote to memory of 5368	1456	msedge.exe	103
PID 1456 wrote to memory of 4444	1456	msedge.exe	104
PID 1456 wrote to memory of 5368	1456	msedge.exe	103
PID 1456 wrote to memory of 5368	1456	msedge.exe	103
PID 1456 wrote to memory of 4372	1456	msedge.exe	105
PID 1456 wrote to memory of 4372	1456	msedge.exe	105
PID 1456 wrote to memory of 4804	1456	msedge.exe	106
PID 1456 wrote to memory of 4804	1456	msedge.exe	106
PID 1456 wrote to memory of 4804	1456	msedge.exe	106
PID 1456 wrote to memory of 4500	1456	msedge.exe	107
PID 1456 wrote to memory of 4500	1456	msedge.exe	107
PID 1456 wrote to memory of 4500	1456	msedge.exe	107
PID 1456 wrote to memory of 3680	1456	msedge.exe	108
PID 1456 wrote to memory of 3680	1456	msedge.exe	108
PID 1456 wrote to memory of 3680	1456	msedge.exe	108
PID 1456 wrote to memory of 4288	1456	msedge.exe	109
PID 1456 wrote to memory of 4288	1456	msedge.exe	109
PID 1456 wrote to memory of 4288	1456	msedge.exe	109
PID 1456 wrote to memory of 3960	1456	msedge.exe	110
PID 1456 wrote to memory of 3960	1456	msedge.exe	110
PID 1456 wrote to memory of 3960	1456	msedge.exe	110
PID 5592 wrote to memory of 1640	5592	SearchIndexer.exe	111
PID 1456 wrote to memory of 6124	1456	msedge.exe	112
PID 1456 wrote to memory of 6124	1456	msedge.exe	112
PID 1456 wrote to memory of 2052	1456	msedge.exe	113
PID 1456 wrote to memory of 2052	1456	msedge.exe	113
PID 5592 wrote to memory of 2500	5592	SearchIndexer.exe	115
PID 5592 wrote to memory of 4836	5592	SearchIndexer.exe	116
PID 1456 wrote to memory of 5932	1456	msedge.exe	118
PID 1456 wrote to memory of 5544	1456	msedge.exe	119
PID 1456 wrote to memory of 5544	1456	msedge.exe	119
PID 1456 wrote to memory of 5284	1456	msedge.exe	122
PID 1456 wrote to memory of 5284	1456	msedge.exe	122
PID 1456 wrote to memory of 5628	1456	msedge.exe	123
PID 1456 wrote to memory of 5628	1456	msedge.exe	123
PID 1456 wrote to memory of 5484	1456	msedge.exe	126
PID 1456 wrote to memory of 888	1456	msedge.exe	127
PID 1456 wrote to memory of 3292	1456	msedge.exe	128
PID 1456 wrote to memory of 1868	1456	msedge.exe	129
PID 1456 wrote to memory of 1868	1456	msedge.exe	129
PID 1456 wrote to memory of 1956	1456	msedge.exe	134
PID 1456 wrote to memory of 1956	1456	msedge.exe	134
PID 1456 wrote to memory of 1288	1456	msedge.exe	135
PID 1456 wrote to memory of 1288	1456	msedge.exe	135
PID 1456 wrote to memory of 3884	1456	msedge.exe	136
PID 1456 wrote to memory of 3884	1456	msedge.exe	136
PID 1456 wrote to memory of 2756	1456	msedge.exe	137
PID 1456 wrote to memory of 1524	1456	msedge.exe	138
PID 1456 wrote to memory of 1524	1456	msedge.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_6aeba1c6e90cdcd9cbab339dd8e13144_cobalt-strike_coinminer_glassworm_icedid_mespinoza_njrat_ryuk_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pc.weixin.qq.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff9bc9ec188,0x7ff9bc9ec194,0x7ff9bc9ec1a0
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,5613257474139479714,6487187163473352805,262144 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,18027686119075633433,3359394755579421390,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,14320545685789636667,12837718862657647550,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,9913047907160049501,814822776063627258,2097152 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,15582214747125974959,16038330557852053314,2097152 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,11143305518860249204,3127525908844666104,2097152 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,13356158044189787307,4042067523735097480,2097152 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
    3⤵
    PID:4288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3712,i,15528185267798539481,8454980586136993121,2097152 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,10977073828054320292,7904469475780636394,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:6124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,1522145144873540164,16528657785604872,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14053636646323418596,14260356206670549675,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,14053636646323418596,14260356206670549675,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
    3⤵
    PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,1096166758247610590,15726991032727480485,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,4507096663444921852,10774748364200311328,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8379286636248342044,7914276160895355913,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,4780860186016444084,3293512253340292979,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,13949518156120759800,14115533570727918393,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,7627467113556659701,9006674936502759488,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,14739781123400377940,16142593275039793417,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,3593551941113172998,8535456749349089301,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,3800211743831784948,6473128979092108816,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16963189649976068909,15800769258668477978,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6648,i,9994628199893362822,8126056861530817923,262144 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,922873475455143495,11715425527673725214,524288 --field-trial-handle=2352,i,5301652743891230138,1908358032118561020,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
    3⤵
    PID:1524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4144

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:720

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2408

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2800 2912 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2768 2620 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4832

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 eba7c8640efe984f5bcaeeaed0139df6bc022fc6f581c770956c10321da5f97a
MD5 6230bbe0d9a918873e66872f470b7a3d
SHA1 7b01ba31f5a349ad957d340fe1b285747e3bee54
SHA512 c7dd59b9404c0d807241225b2f4edbfa96b005ee33fbbfc05a337f1a89ad1f5428d0664c6373baabb87da7e57a8c1a13feec7589ccd9d94ed5fa8e7d8ebc0eca
SSDEEP 49152:wb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnDHJ8MI/WUXZEOMlm:a3q60jBMHUWeZE9
TLSH
T1C1D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 8b3f03181bbb665b318726bce5fbce0b0e7dd078d692ba206bcfcf1966acdde9
MD5 a6555abcfb78e2fa1c06b79ba597f3d4
SHA1 e4d0649a410119b5c795c9a3e81fd08a1b55738e
SHA512 a6aaac3cbea44c2b6a24f6fe3168492a5a6335644d585914ad8550a3c46c1ceae2671ff26ef31ed8183824de0e93eca4858e4ad774eddbe69535c4ee84e005c8
SSDEEP 24576:0XYfDtczA7unHJf0ljCI/7CXkXZb8PgiOMlme0:ztc9HJ8MI/WUXZEOMlm
TLSH
T12F85F128B3D408F9ED67827CC9A28511EA3378554760E78B03E49A3A5F336D46D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9d735ecd8522c65869fb31f41c4efbeda28f1c70aeaa1ebce89c644298a36b9c
MD5 4d314167b5485cadb93c0e67363ff727
SHA1 95f48b9f34ce60012a32a008eb2498a347795586
SHA512 8f608fe889bbcf80504e3cefe5dee051dc80e7266b87ad44301412014b64e5355a3929615d8593da7512ae6f4dfd7abcaddfcbc85cf9cbacb9be9562d360306f
SSDEEP 24576:f0Le5ji0hmxNrMgunHJf0ljCI/7CXkXZb8PgiOMlme0:fPji0A7GHJ8MI/WUXZEOMlm
TLSH
T18BA5AE15F6788335D073C0B9C5D2A68AED7230825B308ACB4296D77C7F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8bf89b414bf8a3741b104b75d0737fbe990e270549e9cd00c2182bc4327f3e0b
MD5 dcd967fa0c31cf13d23ce40ddacecc41
SHA1 ee3a56b418d3eabd14529094d31bc6b6260b7258
SHA512 4d21881c16cea95230c76412bd18085e269ba612c1fd5eda9a72ecb320b9ea49aea1e84f3faf866843167aed25b0937f1e521845c5e1e8866023a40f40453a23
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWr6q8wyuyunHJf0ljCI/7CXkXZb8PgiOMlme0:u/ezSC6vUzPviHjyiHJ8MI/WUXZEOMlm
TLSH
T101755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1fb411d7ef4abb515059e15de53de34fe481fc3b5adfc15150ba3eb4feff3fd
MD5 0012ca8a3f937c8423c31a4a0ffaa8c2
SHA1 9828e125d227e44554a4be3239998f92335816de
SHA512 fc51889a014c14844f374cd31edc721092aac66b3f662c8d86a9015b68215cb91ee36c0ceb61b59a1e0b02975b246e8ed57a697f8f6b8293096b11e852b043ef
SSDEEP 24576:hVbqPb88hv/l+b/unHJf0ljCI/7CXkXZb8PgiOMlme0:hVO88hXl+gHJ8MI/WUXZEOMlm
TLSH
T1CD559E66F5748331D073C0BAC5D3AA9AEE3234424B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 535df28240db3f401e2a0bd8392c54f1338ecb1f4a250bb666ed6f38c23c1344
MD5 1f14a95097e8ffc66739803a51fd7507
SHA1 68f81e455d03e7f8d7839ab57c4f4b3a7d27493c
SHA512 0b05d9e6b61fab6838a78190a3308b8cd2bb7d43fd7a96d99cd1c8d39772f2a00f1584b3ccaf814aa8492ec05d824684e337197a41096690fe6b77066ded28c0
SSDEEP 24576:wj0unHJf0ljCI/7CXkXZb8PgiOMlme0M:WHJ8MI/WUXZEOMlm
TLSH
T1CC752309D24C01C4DF4B2BF4B7668815485B8EB58E22171B89B77F7ED2B8DE2F459223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 fca33f5b2911dd3e5498583587398c16839d15f495a78dc157633f3bc953b898
MD5 2020ae9b608f1fa61396e6175f195f21
SHA1 5250cd64a320c984db41f6d21c26416c9ce603d0
SHA512 a25a9fb5c2836a142f3152e3c2060eac622f6cc645cb23e6929ce24132e7222a10ffd081f1b88701640715f0968e0d0559ea61b18a7e57205847a143575374ff
SSDEEP 24576:7JIUXunHJf0ljCI/7CXkXZb8PgiOMlme0:7JIU0HJ8MI/WUXZEOMlm
TLSH
T11685CF2BEE28ECD2C27A9DB85B918600D77278704F22A3CBD175830EDE235E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b9d6995e80fe819b9b67913c4a65f630a608e8211bb8bb34b1a4e8c246607f6
MD5 75a34dfc5460db921ddca3d84dd18c7f
SHA1 942912799c1be74dc1f4d1aa5ffadd8d12c6719d
SHA512 e04b466e48f0503dcaf39b7ba35d369442172aaf7719d2faca8560c17243a66840019dc658af972c0dcacff2364e58eb59a3b788a6222a8363db2f8c8344b1e3
SSDEEP 49152:zQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THH:zQvGAdlCEL8c/RRNw5CdHUWeZE9
TLSH
T1B8267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b244b9aadd8046dca50c8c646233bad2dcf62d8f0c116c383c1b9761cf7e17f9
MD5 99a188d3ddb8fa9f367a5e115effeacf
SHA1 fd267a0fdaa6e640fd397043314cc4750ee93e04
SHA512 76737d34ced39e05121c14cd60c99d312f95cee3ea1d20f3978368db671d3bf61c0c6597932e8734f38e75ae417a1427a3c0d05d4eb886ea42fd0aa8227b84ee
SSDEEP 24576:PSewsAjBunHJf0ljCI/7CXkXZb8PgiOMlme0q:alj2HJ8MI/WUXZEOMlm
TLSH
T15795E031FA74D036C77B0DB61B36C716182DB9204F621AC3E3E85E9E99706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 638d98a6b3524c82b3c44a592f0639d9ca073e297fd839052f59a1854371520a
MD5 b98f554339c85a7ffd5233ef2d623ed6
SHA1 dcca9c134bf0b6680636d26b872b6d4700c297d1
SHA512 747a0c2a167956c5244d1de15294e8d3a4c46e6981ae241d6d3271a60ff2d78956399d4a2facf20eee79ef5bc9c1768fde718c8cc532989c9745aba87225282d
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH6f:uUEtQevvqc2W1cpV2RI326f
TLSH
T114474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3bbe741b9319449c290df9dff49121a5465fc4a408006f0cfd88481797860395
MD5 c1d7ed9b04491103f1d3e6bb6ccc47ed
SHA1 da29994860ded0d0ac3f077dcc90c84e2f666aec
SHA512 ed4ad80e793580dd280a9104b3218d53fd4066b3f8344b33f5d00b79d0eb028fa84e1c3043bf1818645edd14b4fc6752dcad6822551e5968365d2b9f80bed71a
SSDEEP 49152:PCbRquA/m2yL5zifFiV+XenmE3/zWHJ8MI/WUXZEOMlm:IoqHVjnmJHUWeZE9
TLSH
T1A2D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 48573a88db341e5678adf064f6eec62ad3d7eb7b59e2a2ece0b9fa16e734e532
MD5 eb132e8e7e4bf240f183a9f243a311f8
SHA1 0359ee5449f369abd4e7338df6b7ed7b8784c2a5
SHA512 8df79c3f8553d45db0d9916b1c78d73d3ed10728b728a17728d6b603113ab9c4b00ebd339fde1fc5520a7843bd067d2c1ea18ba4fcc1204a11ed26b67c524073
SSDEEP 24576:5AhGL2IFoiwtA5l7S53OunHJf0ljCI/7CXkXZb8PgiOMlme0:5AM1Foiq55HJ8MI/WUXZEOMlm
TLSH
T149359D81E7F945D4F5B3AAB899B68171EA76BCA65E31C20F2160D11F0E33E909D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c3c082cbbfc98df860ef979436574455e29a331bc58e7491e5d67d9de5545aa1
MD5 9c41725f3e7bfae9ef11efbbc2693c97
SHA1 1f0354e56bbe934ca136b0d856699f25be8efaab
SHA512 4fdabfa647837a3d6a7227ad04c126b877bd9b2e6815ca0bb9de0806fd537989bbac5dfdc1f99bfce3b421cd65f0e0348ad4a471089f91c56bba7b5f7b776d84
SSDEEP 24576:ZwuXOWNunHJf0ljCI/7CXkXZb8PgiOMlme0:ZwsOFHJ8MI/WUXZEOMlm
TLSH
T1DF85F14A72A80CF9E96752788657C136E7B3BC122A21D71F0760CA6F5F37261BD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 ccfa63f0f439e2b30540a3413a2aa3948d827770a962fd6212c61e8a9ca6df09
MD5 0c6e7beee68ac147aba7374168693b46
SHA1 fd9921f0b6c452a512b6a52b2c5be6debedaea5d
SHA512 d3e2806195aacc6f325383d45792ca04482e2bb5ecc96b8caa2f0eff71843ae350cc44a82976a95fa5382ed1e082f06ee02a822240eee4dd091dd23768925e31
SSDEEP 24576:RZuYunHJf0ljCI/7CXkXZb8PgiOMlme0:kHJ8MI/WUXZEOMlm
TLSH
T1D075120A23D810F9E69752BCDAA28505D7737862573203CF06665E7E9F72ED26C39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 70b856adde42c8fc7e12cbdc73d53b5d0afe12d2e5057052664c23a14aa3a215
MD5 ea7ebd173c7fb645788a59508dd7642b
SHA1 793e9b5abd2cf3b8c21c916a511658408388ea5c
SHA512 cb083a6fbbbb12c5dd4595a723bb5236089f3bd1482b7c35cfcd408be22e2bb7dc32a43719adcd57cf1a99a946cec41154ba5f2fbead9cf1f50bfcd38765aa15
SSDEEP 98304:CQRQyi36YOcPhLvw2gAf+PN3QHUWeZE9:ZQyiKahX+PNcf
TLSH
T12F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 00ecbf903a0db94f7da013fafbb358485cb369c2df194aa9a29c2c0ca5ef3afe
MD5 1122356a204faa54313795d721b1e7c8
SHA1 5825b9b43aab8423a037da0eb0b6025febf28e61
SHA512 f6a8db925fd8dcbb4a203f32eb6cc66cbad3c1e648ce652eedc2742e5e338fbefa5f7968b5c8284250d70cbb19e3327449ed296edb3089358e534bb1521754b5
SSDEEP 98304:GQRQyi36YOcPhLvw2gAf+PN3QHUWeZE9:tQyiKahX+PNcf
TLSH
T134667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 73b755ca9b0d6205dd005e43466d47042c92160cfe26b511119870ef4d4ccc68
MD5 2fd47b22aa4af6028f24dfe8d857b8b7
SHA1 6d91c96ab05e80caedd0d5a491de9263b566e9ea
SHA512 77b910491700138aeef73b1b8e6badc970de1c1cec3c5123a42e6904af623bb3aa0c323139e894a3ecab2c702986c87bcac236fc4c3689fdd72af7620ce9829b
SSDEEP 49152:y68Qg55nhceWu7PNU3/GHJ8MI/WUXZEOMlm:wthLRc/GHUWeZE9
TLSH
T1B4B55933B2F60099C44DE1769F4A873196D27C718FE1E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5fec7f3b995229920e12aae84bdecc7f9d6b671a38e8bb28b005e6598828dc88
MD5 a5cd79af35d53e27d81b542a11a57112
SHA1 56b18083d241ea8d8c31784d749c6eb32350bfdd
SHA512 35581382e98b1a39204d45349001a373edc7431646cd221433a63d766940bc996f9eefd5aeae7f45f37783406ccba31193bb315f4dcd30e3208ab71a71ce12c6
SSDEEP 98304:2y5112gYy5azzVva69nLKnhZvHUWeZE9:nLIHjWhBf
TLSH
T1DB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f52eeb3876cb7a8ea16463c08f17280fe0a620ea9f646724602d9440f34b77ea
MD5 98aa163b5d1c11566a1a5b7e41bfa69e
SHA1 304aa2282d6080a637d604adef65689d2215706e
SHA512 82c4531b518db17d697d2b3bbca89f32f61b5cb74e98cafaaf928cc8a0e97cf1e198124c50a0b9d3f5682d6a58b688089cc68b28b78a2e32c705af30f6ac7bbc
SSDEEP 49152:rB+taZ3usBWOBr4tEG20bqx0z+n217aau1glIHJ8MI/WUXZEOMlm:9u6JmUxd2dIHUWeZE9
TLSH
T162D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 91764d21d241a68d9f79405844837dbb9b9801ae3ac68c953f2f86458c2e5880
MD5 c119a10ee289a04a66121e105ec14ceb
SHA1 d3aded72d98e65747214f380a635d7b1510d6381
SHA512 b9e80ba604f1c81042d92f3b336820cccf6e20f44ca2ce68d6a68384cba6636589bf3131f5b24b9962667bd559606e18578d260906f17b3132c6d120010cc628
SSDEEP 49152:/1hpsNoJpF1A6BU44CwH7R4xUHJ8MI/WUXZEOMlm:/mifPkRJHUWeZE9
TLSH
T164B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0bc660e2747e5c7c764542558774e0c036ce9f09baaa0b04338b587021314afc
MD5 9267eb7968f0524959e774f598260969
SHA1 5be49c663b9a481e8258c2fc67c78f32f4f590a9
SHA512 05bd43f2026b9a2167d2789462f6c7b5c9945cb2766b35ae1c55f12c3b7ef741b348ec203182fda2bff7d069ed7463bbea8bdeb6d21e930df2f70c804909e397
SSDEEP 49152:cSuZQIY0Be2KNRVtOnks6NMHqzHJ8MI/WUXZEOMlm:e5dKvi61zHUWeZE9
TLSH
T158C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 da84c27daaf314613813aa124637f766b09232892541b23134a0793e2c6ef616
MD5 014c075dbbca16e570cb60902c9f218f
SHA1 e87be1646b56a21fa1ee8500d623c84fe57af6b3
SHA512 9afc19cb0c110d61538e18b80e08edb244a1ff7d0e9e8d7d9de6b8af8603b120d5f467ba0b3dc6bcbd5c0420cd94eb0a016955ad03b995cf90a6c6eb6cb1fa17
SSDEEP 49152:chtSn8EApI0figXgiDn0AP5w4HJ8MI/WUXZEOMlm:dX2iyphlHUWeZE9
TLSH
T1BC95BE13F2D900E8D05ED178C7568632E962BC160B35A6EF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f22eb33c18a2d718ebee67348506b927e595386b1a394a2915e23a0a7c872ad6
MD5 6e0c26d5efe750dbbff263a4923b15cb
SHA1 40713d6f77f0c633ba1d41945b8cf76282acb74f
SHA512 0de7e9bc1d82f2888f941cdf3087321afe7725e4d979fd142f7cb0e59b43594d2fbb81957f79c2e98454d9b5ea6e716e91702908038adc7c234879a0f59af399
SSDEEP 12288:8ug0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:8MunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T154752309E18D01C8DA0627F4E7228415885F8EBA9E23135B95BB7E3ED7F4DE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 450b03dc92acc75265bcd374b5cf7e7074d6a950ccb852ec4b510b765899cc18
MD5 85d377054b83e2a118047f08cc43f988
SHA1 b0044a922388700500279f511e20ee0a7de104e3
SHA512 98f70e1988ee430a925b162089a7150a1b455fa837667ba0b98545351f1579ed2b3cef425d18ee72ca1c8f8fcd949ecf761c475af3bf21903bec42124473a816
SSDEEP 12288:Izg0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:IVunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T109752309E18D01C9DA0627F4E7128415885F8EBA9E23135B95BB7E3ED3F4EE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 96b4600dfd4066917c56584ab429a3e955161c1a454fd0da6809570283b3bead
MD5 2a43859b4c95e1aa0a26d506a24c5d5a
SHA1 f5294eff9a5616f2bb4af7a1d3ccf8e9f1970db1
SHA512 8ba433afb9104dc7bd3aa0f5872ce758eb6baf2b84b949fc5f4df2cc4a31022973ba2f9931789ef2a762e0a198f2d9254b6143b4ae4f9b0cb9f41a336a773f7c
SSDEEP 12288:mVg0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:mPunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T17A752309E14D01C8DA462BF4E3128415885F8EBA9E23135B99BB7E3ED7F4DE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 e8ee09bf98e0586808a4dc3a739e77185e72dce3beb80d9bf5bb29b949a87477
MD5 66c7d463fc626113fd545194a6db55bb
SHA1 fe033f4bd81062c342cf3ef4136671d463dc88b2
SHA512 cec46a755bb978cafa5f4c5c78fa2ce53d13e29015c34074a75600c76f50519ba99bd25a88e5aec94bc7eb6e71e2fa059f9b1a24eb06f203917132cfea074ba7
SSDEEP 12288:PVQg0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:EunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1CB752309629D01C4DD57A7F8D7228415D57BBDB58B33135F8A622E3E8BB0BE1B438722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 cfcaf782b26e373b304834875ffce3b848b7d0e07c37c56ecbe5dee932445f84
MD5 005bbb7551be95c39c4dc1f843381b8c
SHA1 77e13311592381dd1baa4bca2d5fe5fbb04ddcb2
SHA512 f97764bf593975ee8ce39fa744f89e4040100e274c100c3b9f753382b7e492541f3e63ffe42eb6889cf30f970aaaf08f4f73e5a87d1c53334872b76d7e4eac84
SSDEEP 12288:xog0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:x2unHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T133752309E14D01C8DA0627F4E3128455885F8EBA9E23135B99BB7E3ED7F4EE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 1c2310aed571bf7b0c635062e1a8dc8bc56a0be9665fb38dcae6298aedb6724a
MD5 ff8e88c357b34e56d5f6b9b76beeec88
SHA1 85f08003d8ac1e73ca2a92e6bb72292cf2dae1aa
SHA512 33966b04a2a60d4a6e8f44085172517927ff8ad2cce8f4bdabaf594a25ca1ad8cb6ea05ac280a0f6b87ba3d792f34113042ee89e22f191b0e177f72c857d0c0f
SSDEEP 12288:EXg0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:EZunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1BD752309E18D01C9DA0627F4E7128415885F8EBA9E23135B95BB7E3ED3F4EE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 19e0001a3e326a3e13218f641f5b0948475961e95e4e2f837858faf5266e6795
MD5 a3657a7bec3d9fc3b732fd896f80b73c
SHA1 9a0263edbb50a73f35d23cc76bc1fb317050eceb
SHA512 2974dd44fd86f1a7a6e5d678d7eef234ea6c0afa09b5ce7b4fb8417f56c50544790300c267cea0a2eacea3a3cedfd4c3cba2faecb25080384a91b95e994a3c64
SSDEEP 12288:Jrg0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:JdunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1D5752309E18D01C9DA0727F4E7128415885F8EBA9E23135B99BB7E3ED3F4DE2701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 362ee5b61ae3124593ef238a6b3c787bc79e0ca2c3500a8566ae8b2d0e650652
MD5 e92ac146e11a6802f2bbc1770d3cb139
SHA1 b15ab9b8f60f89d56d85206bd25ee2e677ff04d6
SHA512 0c2a479a090569d7fbbf4f41c808bc3c41871c61569d78868d1717a8b5a1ef52d27e3c0ec351a5b1ac24411ff8211169f0d8cc095e55fc602c3f2ecbcd4d1ed3
SSDEEP 24576:rZMMzFVSO1unHJf0ljCI/7CXkXZb8PgiOMlme0:rZMMzf+HJ8MI/WUXZEOMlm
TLSH
T12185F155B39408F8ED67827DC9158906D6B37C6A0B70C61F03B43A2B5F737A12C2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 4ef6b631bf613ee97a70531ffea7d19bc9f236090b90a430a0a254eb65d5b365
MD5 827d6e4cf0f4d6d8701bda680e6e7084
SHA1 aa4a163a50819fdef72ea5cb4f1d20874a8262b0
SHA512 a6a268dc214d6ee833b95cee2e02d0b897bc2cc2a54654f835ea42baa812b574c1c2b0ebe077acc03942378320f51abc7d9cf118b96050fde41735c584c77633
SSDEEP 12288:m6g0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:mIunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T12C752309E14D01C8DA0627F8E3128415885F8EBA9E23135B99BB7E3ED7F4DE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 692b7131a34c84dd871150bafc2105ce3c684c7505510716976a7df7402dcccb
MD5 b5358cfc320e61be36cb11872a56e8de
SHA1 986650314f5f8aa7fc08ad6139a0b95bfe20c538
SHA512 c91777b5328b9f3414c41ab16f6b7a3bc226403fb26d9675ac07193a007590aa2639885962805a22d1bcfc4dbe466e75d0c2fe3d51633ccb5434fe23db46759d
SSDEEP 12288:32g0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:3kunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1AF752309E18D01C8DA0627F4E7128415885F8EBA9E23135B997B7E3ED3F4EE3741D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 f1233fa8954085807d62cf921c291f7aa57a5cc46846299b1db71c5c97f7b6ff
MD5 eacb2bad21319932f525f7800c6ae4f4
SHA1 b2042c0948f1458bc73479b464e0fbfacffea993
SHA512 1b660192971f5f40400c45980a0f58c13352d9d66573188e32369f96c53ad764ac73b77df6fe0a98b1cd00bb3328da26e55314325c57a3a393f20ec239a36df0
SSDEEP 24576:+zyxunHJf0ljCI/7CXkXZb8PgiOMlme0:+lHJ8MI/WUXZEOMlm
TLSH
T16185120773A920F8D5275278C9620901E777B8320B214BAF57A41B7E5F736E1AD3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 b8032bf6861911067eefcaf14d75524fc5ee71335ca904ffcdda5344e8c6e2cf
MD5 3e413696704f2d9314c0b0978fa7ab5c
SHA1 59c73be3e930955f0c59b58adce3339a95c3d5c1
SHA512 3f4a0c58664273a5f4ca7389be657864c8a2d502d7ab6e18ccda3c408b372e136ff2d9292d6299e1f854bad3d89dbd1db2cc29705a958789dd6d47c9e05a220c
SSDEEP 12288:X6g0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:XIunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T131752309E14D01C8DA0627F8E7128415885F8EBA9E23135B99BB7E3ED7F4DE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 bb049f5538f6eb966d3a980f08777dba1045154dca7524f6a3b91b148b2d93be
MD5 52ef0740c381712103e91bb8464a0772
SHA1 4ee3365cb6a888957c15aa637d69b8294b218f32
SHA512 d8d1f28e2334f5bdb03126d17dbdeb0b756e65509bf9a370588f845448a06f3788d07db5d328a73c02bd318a98408425f041f8e175398f6cf7b3a5b79623f6e6
SSDEEP 12288:s6g0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:sIunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T159752309E14D01C8DA0627F8E7128415885F8EBA9E23135B99BB7E3ED7F4DE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 73c6310cc7e29c0e713a6c7bf3350393fa77562f39f09031b9a141d1db28ac27
MD5 5dffc13c3f8c7553191ce8a51bd1fb77
SHA1 abbe93552f399c1b9bd5a7f227332ad064cb4252
SHA512 611271fd4dd77b3d4277fc27875c4a1d74cd7556e6b5b80fd9fd6bc367dabfe319f21ed9557a059c85db91b1b22bd65f3503071e8f3dd16039a6e7106c3e5d16
SSDEEP 24576:jzyxunHJf0ljCI/7CXkXZb8PgiOMlme0:jlHJ8MI/WUXZEOMlm
TLSH
T1C185120773A920F8D5275278C9620901E777B8320B214BAF57A41B7E5F736E1AD3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 74b3446e6bef320f2c9e79e663980fb9201307a95bc23eee037535f83b375c0f
MD5 5dba1c05b4ddf002f265b7c059727aae
SHA1 fa9a7ba6ca2cedbf080ea3b62051f42638b03e23
SHA512 c67b465de0984d9404511f3a13f07a349c80e5054a4db3ea5250588608139446f01f749e78ecf5855ec1d8cecfd69dca8976b118bcbd093f4f6122a191324521
SSDEEP 24576:xT9aLl3z0zDfunHJf0ljCI/7CXkXZb8PgiOMlme0:xTQLljtHJ8MI/WUXZEOMlm
TLSH
T152850154B39408F8ED67827DC9168906D6B37C6A0B70C61F03B43A6B5F737A12C2DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 14fc8f0ad194a8f9bce2fe7c9db28e1f8195404173137f0d68c869efa4110bd6
MD5 4542c441f4e9cd61c1a5e1a25d9333d1
SHA1 1dab9eb2f2db9df06fff5307cbff4cb89e6f903b
SHA512 d6a332b704997d09421b0615a13b18eb9d3387901c3ec1e2673bb42b67f4b8001389a42a2e57b7e5ac3e5a0e0455cb3b1a7bd30a8fafb75137e77892fcfb9701
SSDEEP 24576:c3td9CHKy7GZzunHJf0ljCI/7CXkXZb8PgiOMlme0:Gtd9CHKya+HJ8MI/WUXZEOMlm
TLSH
T1DC95CF90F3E810E8F1B79A75C9724511DA777C6A1B31DA8F03A4261A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 59be8bc0935029e5a7d37d6596feb7e6c9700106f8a8a62a361b0bc90a1d7c59
MD5 7595e7781750b3d66ba24853e0a16675
SHA1 f0a8c1f7a0a1ffacc9755b6fb5551a714bf706d7
SHA512 f3fda127c4477d1187fd4d8a048969828f7dc91785dd82b84b400388b924ac79253bfda9e722ad19ed78043ce91190a673370a4f2b761614dc3555f932348cc2
SSDEEP 12288:51g0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:5vunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1A8752309E14D01C8DA062BF4E7128415885F8EBA9E23135B99BB7E3ED7F4DE3701D266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 dab06c826ee48507ddec85382252cc8d8939c50d04b5c5bf52720f4d61c4ef8c
MD5 e118a8a0d737ce5a16520600e8c70fc4
SHA1 d747050f91ecec4229da0b916a1873b41d68fe5e
SHA512 80e9cc711de05145e6810749b9b38fc87e6bfa571877eb0f58c2267c8ddb0db995bd08f8c5c7c59a360e966422515d9045fa05c4ed99d0013144d6ac6d1bb747
SSDEEP 12288://g0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:/RunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1F0752309E14D01C9DA0627F4A3228515885F8EB69E23135B96BB7E3FD7F8DE37019227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 64168b3399fa19a92e9ee36130c2692b665d0b17469b300150cb65a3507de942
MD5 d71a7a8952f3ed50ffa71f84ada5e3c0
SHA1 3f6d8a643246f8a208abb0c1cb09a272f3592960
SHA512 8b5702384a7a1122949544cf0ef307a9aa9a382ae47ab2c3a9d8a5c2a999c3a340c4d689c0fdd60e6ada612a873351826f5f7bd3e3ec3b2d4032787566f96148
SSDEEP 24576:jfwvok9RX6wkyAIUunHJf0ljCI/7CXkXZb8PgiOMlme0:FMnYIPHJ8MI/WUXZEOMlm
TLSH
T141A5D029EBDC04E5E177927C99B3460AF6B278691B31C2CF029A536D0E37ED06D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0041aeaf77d81b7d959d93734ff4578f7d6864212c143ac0912c599e219a9f81
MD5 a8b4f3c7f5feb56826e3cb75f6a03f7d
SHA1 406495d25bb2ef7fedea36aa3c108a6112b38b01
SHA512 ad4b84b8a35f0367a9372f165eb63600cfbea4e3a48e0085aad4764f20cd63dc74c22ddce7a2fc2ae8838a8f5ac2ff86323325f419e0b87d507f084a657ec7d5
SSDEEP 49152:cYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YHJ8MI/WUXZEm:0ySzPwHUWeZE9
TLSH
T169066C56A1AC01D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5f5ba85c781b4ea5aae873efb073b363d8f91273ccedff8a6e0d39e3d343ad9d
MD5 4ee57f59ed152ae67e67eb7db1106387
SHA1 6807c54913e716899d684aff56199ae68a5be727
SHA512 da4ed7ffd00713443f61f53742ef7d0b858bb7f22be973e114e0a3b33a2d6a966ab46797f84e54e7de76a4d20b56eda44f2bed57c21ae06bdcefde7232a75f11
SSDEEP 24576:X47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYlunHJf0ljCI/7CXkXZb8PgiOMlme0:X47JUQj4irIhCnDHUPfF/IHJ8MI/WUXz
TLSH
T18E65AE1EA3EC01D5E1BA927885154A1AEA71782E1F32CACF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 4f16b1692f3f7f10f5c7c747f3cfb2d88870d67d2073363f0889a6a5b527926b
MD5 2a080c92620cb6d6074bed3420a836fd
SHA1 c80c329793005300859f4860de41d503823c204d
SHA512 5069a9199cf5620dc8a0f1f85343d2206f186bb40080029894c45f5082e984076ab9f5a7e68346ceb3285376f89826eae4392aca49a649642a71b26908ddf0c4
SSDEEP 12288:5Gsfqg0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0:LYunHJf0ljCI/7CXkXZb8PgiOMlme0
TLSH
T1F585F109D29802D8C06E62B8C7528A01F7377C6587E293CB56D1F93E1F75AD1ACEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 d6606c10137bdf51c39989dfbb667d8ca0b97b24df0ee0c5b5f55f830e21c803
MD5 ebd6c6bf95783668e54b181042d0d3f3
SHA1 bf9f0201df4b9a4e4c4b52066e098e44ba66f32d
SHA512 5d059dad19959633f9d46faba4cbe8cd737c6d04ce1a6176cd425510b671ba16dc8c6828709be01056eba18b6e0f862282778fed6f64280e200bf48aec292fa3
SSDEEP 12288:WZqaU3f4EMFqC+voKY3zz/GdhN8WrCYW/HVYSKmuPJIa:WZ9UP4fzz4v8WNW/HaSJuKa
TLSH
T193351750766BC75FC6A940321E32D1CCAB707D41EE45AB0372C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 350KB
SHA256 23e4aa56df5459ea7ee5517d18bb0dcd64c91461e815a16e73fcad5ba49faf1f
MD5 c6e360e09d41c47f70256f949c9e2035
SHA1 1bdf44ac8774cc8233afe9894b73606e927f9637
SHA512 8fa9a30077a825b28f51a83525121038090e679c469046ba607fbad0b53330b4e94e27819814a9a0d6846eb319ff5c89203d7d184a7da7551b33f7da4066f2bc
SSDEEP 768:eVlToOlTPBlTz2+EQMhR/TpC/TVlToOlTPBlTz2+EQMPRqe/TNdVlToOlTPBlTzU:JthAxFDdHnYeIggeKIAZI9ca
TLSH
T15F74D711B754F22AC4B68073987092DFAF38B522DF125B023BD40DA9DCF219B2776B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

420c04d0-0be5-4a0b-b7ad-e595f5a9da25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\420c04d0-0be5-4a0b-b7ad-e595f5a9da25.tmp
Size 39KB
SHA256 35e187014d6ada362f6f1bc2818f6b030f3353add9584e9cc5c404054d4f7b2f
MD5 b5b80c636e8953317c447a153cd4a1cd
SHA1 bf07d46417ff6af116fb896a24fc775a5042dab7
SHA512 4541f68fbf697cb2a7b367f2030de845e20a0d9d7f01f00197e36ddf2ae477f9c8b1d3f92df723bfd03eb97a8755790111fc4ccbe5240b3ca985b9397186f154
SSDEEP 768:rrv+4UNbdS3UXi0tZoHrEnjN3Gac1ozeVH1SCz:rbsbg3yEHQnjMazEH1V
TLSH
T12603BF3165B8DEB38CEBE386718376437FB416A385850FA4CAD96B0D06875D8230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d66cbf9079416a6cd9b444639827a45230f16b411f4e9cbb8c175c72bc0a364e
MD5 abe1459fab19383b5868d2ab978bae14
SHA1 0e7eb90664de1f3d0dc970b77eca2de49406b140
SHA512 599363940fd0322792bb1b4a1f28b2da1069b686a6954fe088970e5108103ba73f050d73d4ccdc9821ae54000221e21fe5532287dca58c1319a026736d1d09ed
TLSH
T18161831423658AC2DF1C5EB117D0A02837FC8E582507AE1968C2ED39EC82F7873D011B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eb50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59eb50.TMP
Size 3KB
SHA256 d2f3978195310d2025338c6936cd10acc97cbee9808eff289e0e354e23efbe05
MD5 cc8b70e94dbbaad031a63126a16276bc
SHA1 65ac14abdbfbbf76c7e4a842bbab0047d5dc066d
SHA512 c542cbdd2b169956abeed55ac5063fb9e7c4c0a82720ab88d753eadff3c2e4aa68764e0aa3b406e727854e49da5147095e1ac9eeeca96c5e54b55f9fdbd2f1e4
TLSH
T19661921433258AD2DF2C5EB117E0A02836FC8E582507AE1968C2ED39EC82F7873D011B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ff053122166417a22c769259e8644253e8af8c787b3c633beb1c0c7a810d3775
MD5 69572dec503f07878154c1eca998494f
SHA1 a4713a3ac961578893b2ce6f5b2f97a4c38b5ea3
SHA512 312a5f9262c0dbce033805d1f0a583110f1fff9835fa78f179791a0231f34b3a218d832da84e475224455aa58b4fe31433b968b87c8c6847ea1b1eff21009737
TLSH
T1BB219DF3C3E8567D894181F866182E1BCE2D0955832C3E5AC9D4AB5BA3E18B1E25095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 19faede1c14d28c03675dd8ef09f9f6c5ee8e71659c650dc35baf13dc3c287b7
MD5 afa6085f37065ae79dcc83262b7f0b97
SHA1 5acc87faf9c2ea408b47c563b8200d2a049bdeda
SHA512 52b6dce86ab1c55251385e443591bc6fa78d7ec7e66b8eabd98c70ae5d6e39e154aeafe5c3e35771978dbd4e63751eba7a491b05c634d91a0e732146b5840b3a
TLSH
T1F341CEF3C7F8966E890156F0AA187E1BDE1D0925432C3D5AC8E4AF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b0ea1ed43acdfdaa61a8979fda56637f1ee227624a4e830c225d9cd211c2ace6
MD5 c53441cc4a289f984a60af26bce52553
SHA1 980006a32f3e97a9ac3593a4d12bf88f8d220fb2
SHA512 2385047cff03c214ccb5be5c68565a293b2e834caacd89b95a23037ce551134567be48b7a94ec98c343b8a154ebfb3fa0c01dd5f63e5045bcc00026e5b14077c
TLSH
T1A821CDF3C3E8567D890181F867182E1BCE2D0815832C3E5AC8D4AB5BA3E18B1E24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0ace474de1b7386c0227e19c5feb3fcebc56ed2f2aff9a0195d59cd1a1313abb
MD5 91009de2779bbb8c6b7ca24a652a00e7
SHA1 4c07aa9bef3b8eff6123dd34dce2c8d5ed79d608
SHA512 f5ec89ade20620dce864dbf9a130630af819a4e9337b2a8cd1fa085981f1e6aaa9c5d05eef1c24f152a2b1e77385bf7b9abc18d3b5c262f0c5d25a08307e2ed9
SSDEEP 192:sxRNrCc/f+sdmsfoWZUzoA8pZk/g6+WNk+V/YD9p6Ss+GMnIgDQDJ:sxRNec/f+sosfog1m/57/RSsaY
TLSH
T1E142C81AA9389D7B4CC7D259BA16BF53E6F95032A1901E44EBFC9B0C04EB6DD120340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d91ed8ad68f52839fe49849dff9e135fe51703e4d1d1db8df971775fd071409b
MD5 0f6fcf55c0d31266c35373680dfa1b8f
SHA1 026d9706abdcc32c3bdb0c4f5f93f090ae99896b
SHA512 9d5bfa361ebca1c44a5ac3a2e877ab8bbcf3b5ca0ff8334e744f103a40c3fad7fbcdc07f9155bbefbf311633da76c0755da5b0a2de5038858ef4006cab21d3e9
SSDEEP 192:sxRqrCc/f+sooKCA94/4zoA8pZk/g6+WNk+V/YD9+6Ss+GMnIgVHJ:sxRqec/f+sooZ88m/57/OSsaT
TLSH
T1BE32B816A938AD3B5CC7E25DBA567F53E6F95033A1D01E44AAFC9B0C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d5f4352ea3b9df5dc9ecfafd7237819ce9c8c27839a6cfee957c218dc0120932
MD5 f153c4b2fa56d509f07d88d61e14b12b
SHA1 c41c56c293b18a23eb008f9d6f44c8c6e9d6727e
SHA512 3f1120bb8664f7ff76a157b0b62741e189081d972ff579462d806ccd1f359b79bbad39f5c74006a96ae76e416ee160fbad7434b0e5aa6902d089133fd934c879
SSDEEP 192:sxRNrCc/f+sdmsLoWZUzoA8pZk/g6+WNk+V/YD9Z6Ss+GMnIgDiDJ:sxRNec/f+sosLog1m/57/TSsaq
TLSH
T17F42B81AA9389D7B5CC7E259BA56BF53E2F95032A1941E44ABFC9B0C00EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e08b9256bed41a59eb3439ab71b952c91bfeac44de8841d6e67534f3ed95a79a
MD5 ebf073eda472ab0e21d5e27ac41a3244
SHA1 989d02ca16c402bd25e5b9c450c20117ef285858
SHA512 f7c730f8bb76d9dd23a6ab44dfdd9de07735859660a09334bee49622f2f3026337b51de5f0a8e0a26b92111a2b2b815991ab4491b881e9c116705fc58d56137a
SSDEEP 768:azfWAL7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOc163rophB3xD:azfWAdE7J0Wg/XfHfu1jazy6kphX
TLSH
T135C2EA3B640CCE7F4F800ADDAD197EDB6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ea1943f-0eec-48a7-a547-81ad69a82746.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8ea1943f-0eec-48a7-a547-81ad69a82746.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 96d4d48073107da3b8f359b363e73b4917e6b0ed7bd713a88eeda7d3fbc17e8e
MD5 2b907188c14a157b9ba5d150ad26b3d4
SHA1 522d9f8d47cbecc69b095007e32a0c642cd3a98a
SHA512 4557e5040ba48df43b0b465a76ca4840c026a89080160b10dd6761e1384fe7236ccae959f602c53717a1dd18202294d7be629ff18bb2e092e53ca0f5c8d3a2dc
SSDEEP 768:qrv+4UNbdv3mqKjti0tZoxjrEnjN3Gac1Fzb9Ml:qbsb13Z6ExjQnjMawb+l
TLSH
T18513B0317868CEB38CEBE285B1477A537FE416A785C50FA8D6D5AB0C05875EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4f2efef9ac3c1887c7cf3989860aebffaf076521bf928576a17d9d6f4fb0660a
MD5 dccf45cb17fa1dca536bfd3a6ab351fc
SHA1 9790cd36daacd686016acf31cd254ef535280249
SHA512 309698c87db240932b326f44f345d845144b120a6805b3387c0c76cd2312a7aebdc307ee786f60296156e1cb75ea92b30aee9bbbc7c4f03224d7467a2f33a577
SSDEEP 768:aFvj+9Y3dwgqqKjmstZoJLrEnjN3Gac1Fzb9MS:n9Y3p4EJLQnjMawb+S
TLSH
T101038E36A865CEB79CE7D7C6B6477A46EEE012A385C94DD4DAC8AE0C00C75EC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f60a0a1bb4bd8031038f3eb4c4fe6daff197f734fdd0ffed35d8b10da50e1cb0
MD5 c75e6b35ee075cd1097dbde74b4f031d
SHA1 26e5a5e3508759f175d5a467e6088e54549b7359
SHA512 f8a4febdb1af4497b3320c393f762ffc00874e7111024a4fda5ae391bf719448d8c7b497c91ed4d1e3fd4567337448020c5fd6da7bdd094763a63c2e4de037c9
SSDEEP 768:Irv+4UNbdv3GqKjti0tZoxjrEnjN3Gac1FzeVH1SCx:Ibsb1356ExjQnjMawEH1X
TLSH
T18A13BF3168B88E738CEBE385B14776437FF4166385840FA4CAD9AB0D06875DD230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 75d79476e2d0d869c3742d5ad5a5507cecaf330685736a6d284a634e42b38c2b
MD5 c7806b36f61c4fdf4cf3ec13606a2f55
SHA1 7e78711247bd18d984384ff8d6ff513cc22e1c1c
SHA512 7d9dfb120916e57163b62a16197fa05d1e2847c60812c912ef7d16bff8e453284ee09097f9f738f128f9ea3054173846976f3839c52bc9772f7b84bc4280a6fe
SSDEEP 768:2rv+4UNbdS37qKJti0tZoVrEnjN3Gac1FzeVH1SCx:2bsbg3u+EVQnjMawEH1X
TLSH
T17513BE3169B8CE738CEBE386B1477A437FB4166385950FA4CAD5AB0D06875E8130F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b7b662d14beb9487dd12d95ac99735781319263a2df69e8a7a9dc6918257357b
MD5 f064b3bf7254d45a24afb147a727a190
SHA1 34007e6457532392f6dd90b5a6b318b86b9161a2
SHA512 c7b0fed75c087980d32595acef0d42cd66c397d8072b9d50be8263a6b58fbe8c4727528234c2dfecfebccd2a978b76b92a17eb4fbe9a259c1eab8b4d0d273e1f
SSDEEP 768:arv+4UNbdv3iqKJti0tZoCrEnjN3Gac1FzeVH1SCx:absb13l+ECQnjMawEH1X
TLSH
T14A13BF3168B8CE738CEBE385B1477A437FB4166385950FA4C9D5AB0D06875E8130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

80d748b5-b705-418e-9b7a-e9624f548a42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\80d748b5-b705-418e-9b7a-e9624f548a42.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1456_560681039\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 5735fcf2da4166b2134bda59e8ce598d53b255ccf74ab631e78771d27e619d08
MD5 55cb0a9421ae7f1859a506cc3ddb0950
SHA1 626aedbad58b029a6f969b1a9149e1f951f1d747
SHA512 6d943c1820bec4bc0f915f649ce194e2844c8d9e1e6180b19c83feb4b0b5520443dc9b599e51b9c94521b02995b49299f0c61275138f31545d81ec0c9f40202e
SSDEEP 12288:uz7ig0unHJf0kkB7vCI986mkCGYkXaw//8NkiBpby0gid3sm463lme0t:8AunHJf0ljCI/7CXkXZb8PgiOMlme0t
TLSH
T1D3752305D38C0588EA6727F4A326C424581FAEB54F2212DBE4663F7ED2B4DD2BC79217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f55fa10c5675010a86172e7605068f4788ee22d77840bbc716773efad44e40c6
MD5 4a612e8f810faab32a6ffacc92684d03
SHA1 1a3c8215755db96f5caf5dd6e7335814aac915f4
SHA512 c59fde6b6114f7f2d20d93f2e40a9cd4bde59c8c4ea7360abdde1dc8b6ddf26a42eec4995296066035f2d5d304692e113699c08dee8d3929335ba0585445ce2e
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYyunHJf0ljCI/7CXkXZb8PgiOMlme0:8gb4mBIBhGF6HJ8MI/WUXZEOMlm
TLSH
T181659E1E22EC02E5E1FAD2B89DA64417D6B378160732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 ecea337d1ae4c3c510b6c93fe15c2a0794f09bce9996a0ce3666d0544ce7c526
MD5 5e549c9990ff9589959f4d3de251b476
SHA1 b6bdcfa62feee2b33598c5f6ecb1cbbaa95a67c3
SHA512 202eac790b1d6be728ef2b508a5516c2e37c0f29a06b3263fcbd83e4ee19117a83e75d665a7acb05b18330da0c63f9221f51264b80c292306e65101282b96929
SSDEEP 24576:CG88u8FpJqH1Wzria7/m1unHJf0ljCI/7CXkXZb8PgiOMlme0:Z7ZFPqVha7/1HJ8MI/WUXZEOMlm
TLSH
T1D2A5F16577E501F0D47BD1388A424663F6B2B8250360EBDF07A88F651F23AE15B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 3071881162a9c96f46eaaff22b92e34db7cda172681b7f7eb7c0667c9367f659
MD5 52da44979e48dfffe8141c410645bda0
SHA1 918d29e483014a25883159396dee604b286f4b94
SHA512 0af716ac8803e173470dbb6173e408194e191158a3978e0dc4cf349ba57f9d28facbefbde288f1713369baa2aed32cf2c352fa44a5ed9fd97232d7b455877835
SSDEEP 24576:gPUr+NQJunHJf0ljCI/7CXkXZb8PgiOMlme0:gJQ+HJ8MI/WUXZEOMlm
TLSH
T1CF85F21F62EC18E5E676A17C86428619F772B862071292CF02E1857E4F77EE8BC3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d70b85aaab8862fa1c4a29c0895bb7e26bb624f501e27a5da24ebcf78a448e0e
MD5 67ea228bf15035cbfbbc7707f20b5c7f
SHA1 ca5f4e931899302de755ed32f05c6d848efaf256
SHA512 06503b105db883f3f847311753313a06afbcdf3c476897dc8dbcd0013d92455b3e39e4873029286edb39a16c49a540f88e8799d2837da8e42308111084c98614
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOHJ8MI/WUXZEOMlm:NG05lO43bXHUWeZE9
TLSH
T1F2D5CF6E62EC01F9D1BBD17CDA86460BEBB23825033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 52717839b8e2a2d93a0a916ee389ccb87dc30bf388dc6c44c47a3c9eb5f4a8ef
MD5 824467159a0d2f677807a583de924f52
SHA1 4d5810a928e863e5234bcf7ff3e069eb2f13df59
SHA512 f9e0f152fe1c8bdcd52116a672068c4d3f621b8169cc584ed0b6882d6f6e686b06438856349ec13bd96fec51363810ade3ede8862260319f5596454d5217eace
SSDEEP 24576:xfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnbunHJf0ljCI/7CXkXZb8PgiOMlmN:Ra5POZ39Jt2pasx2+mGHJ8MI/WUXZEO3
TLSH
T1CC65AF5EA6FC01D5D579D17CC583861AE5B2342653329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 906f6c1ea55b246079018141e3c9b8e403196a2b01cbb85f6e66ef91a35a0e4e
MD5 ba5d0ca4e2d4b06c8e593f02e7c09932
SHA1 40ecee44643c8db630796bad9081a28424fa47d0
SHA512 1b0ddef64218734cb1170d9fa3c71d9c194e515e4de164ed82e56c95a91b0e2f65d6665ba4c42b8f82e474395fad8158e62fd56c41aad4fc8f375884637f2255
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FktunHJf0ljCI/7CXkXZb8PgiOMlme0:eNc/zEOVHFVHJ8MI/WUXZEOMlm
TLSH
T1D6857B1623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bd3bd92365a422cc23b6807ec48df9785244f95b533e686ab43e6d6861d2654b
MD5 c03f32c7dc172c73b861916b303d4f68
SHA1 feca218785876891cf8e2311da4c92a5214eb628
SHA512 8d9260805f20d336579727bfb7d9fa91c3ea4f46c6e9ec2561f7e39eb13a83b5ba4c881ed13bc5fb07a2ad290a7eeac55eb5565e3d412e52ce26fd6cd4d713d4
SSDEEP 24576:gtkNvNnaFeYhJNtmZBmHunHJf0ljCI/7CXkXZb8PgiOMlme0:gtMwBtOmkHJ8MI/WUXZEOMlm
TLSH
T1CB55AF2EB6B806E4D1FEC6B4DE238512EA727861073253CB5290C13F4E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 1349eb4126fd999300fb67e5c0442df83b16a3081445a36adf3a690c3a2f2757
MD5 64057d62f7930d43609edc05a597a0dc
SHA1 bf7e29ded6b0d5bf6a1b07a6022dde320b0ff222
SHA512 c9599a5212c190b2993ba6242f507145c2b5f28f0283f48f809f0b0081f3f7b9d954eaafd00a0338b196893123caaff1e7e8f87a0731cc3001f4f10a537f2d50
SSDEEP 24576:oD3FHshBIYQgAsunHJf0ljCI/7CXkXZb8PgiOMlme0:oDVHeBIAAHHJ8MI/WUXZEOMlm
TLSH
T1EB95E13DE69C00E4D57BD1BCD6638906E67238A9033266CB02D491BA5F6BEE47D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-65-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/720-281-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/720-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/720-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2408-115-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2408-121-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2408-414-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/2408-113-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/2512-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2512-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2512-21-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/2512-15-0x0000000000EB0000-0x0000000000F10000-memory.dmp

Download

memory/2680-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2680-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2680-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2680-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3100-353-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3100-359-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3100-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3100-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3100-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3100-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4080-311-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4080-7-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4080-8-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4080-77-0x0000000140000000-0x0000000140393000-memory.dmp

Download

memory/4080-358-0x0000000140000000-0x0000000140393000-memory.dmp

Download

memory/4080-1-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4080-0-0x0000000140000000-0x0000000140393000-memory.dmp

Download

memory/4144-39-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4144-38-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4144-45-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4144-60-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4144-62-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4144-46-0x0000000001EB0000-0x0000000001F10000-memory.dmp

Download

memory/4240-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4240-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4240-607-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4240-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4240-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4240-605-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5592-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5592-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5592-448-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5604-78-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5604-84-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/5604-79-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/5604-305-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5616-251-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5616-51-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5616-58-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5616-50-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/5668-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5668-415-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5668-417-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5668-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5668-102-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5668-108-0x0000000000780000-0x00000000007E0000-memory.dmp

Download