51f68dad69aad9a43092c3280e8a3ebc382d5d14d0fe3cf3d79e10b3f1fa5744

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
Size 14.9MB
Sample260804-262sysab49
SHA256 51f68dad69aad9a43092c3280e8a3ebc382d5d14d0fe3cf3d79e10b3f1fa5744
MD5 304b2f0cf5720e8c2832ba36f964ee11
SHA1 8f459d39013e57a63c782c2c51e6b81966c7c3af
SHA512 6a43c554e51d07352e66fdda183ddd1af615469a12a502e4d82a0446c90acd2d652d73f18952fd0fdfbeec06b9f508b6375fab162834df0cbdf46f9af75b4410
SSDEEP 98304:77aQkrJ0hpjhsnzsHcXoDqPtHCrk4cnN1zOFEjIOlxPqH2ExNS3jxakZ3iMc4IID:7RUysEbkPO2jj+tOjxakgfgeXS5Tp3n
TLSH
T130F66C04FAD78075CE7702318A29A6FE01EE5E6D5B202BCF512CFA6934315C17876B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
764	alg.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
4644	fxssvc.exe
2704	elevation_service.exe
5044	elevation_service.exe
3720	maintenanceservice.exe
2376	msdtc.exe
4776	OSE.EXE
1272	PerceptionSimulationService.exe
888	perfhost.exe
1844	locator.exe
2308	SensorDataService.exe
4092	snmptrap.exe
4716	spectrum.exe
1628	ssh-agent.exe
4260	TieringEngineService.exe
3252	AgentService.exe
4908	vds.exe
4284	vssvc.exe
3156	wbengine.exe
2068	WmiApSrv.exe
4792	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3dead3b17c8d181e.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2296	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
532	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b44c8ae96624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079ba0bea6624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff0352ea6624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068894bea6624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{026CC468-4647-462A-9B69-28BD0D9D3E59}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4256	DiagnosticsHub.StandardCollector.Service.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
4256	DiagnosticsHub.StandardCollector.Service.exe
2704	elevation_service.exe
2704	elevation_service.exe
2704	elevation_service.exe
2704	elevation_service.exe
2704	elevation_service.exe
2704	elevation_service.exe
2704	elevation_service.exe
3104	msedge.exe
3104	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2296	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
Token: SeAuditPrivilege	4644	fxssvc.exe
Token: SeRestorePrivilege	4260	TieringEngineService.exe
Token: SeManageVolumePrivilege	4260	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3252	AgentService.exe
Token: SeBackupPrivilege	4284	vssvc.exe
Token: SeRestorePrivilege	4284	vssvc.exe
Token: SeAuditPrivilege	4284	vssvc.exe
Token: SeBackupPrivilege	3156	wbengine.exe
Token: SeRestorePrivilege	3156	wbengine.exe
Token: SeSecurityPrivilege	3156	wbengine.exe
Token: 33	4792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe
Token: SeDebugPrivilege	4256	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	2704	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2296	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3028	4792	SearchIndexer.exe	114
PID 4792 wrote to memory of 4600	4792	SearchIndexer.exe	115
PID 2296 wrote to memory of 2152	2296	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe	117
PID 2152 wrote to memory of 1500	2152	msedge.exe	118
PID 2152 wrote to memory of 532	2152	msedge.exe	119
PID 2152 wrote to memory of 2368	2152	msedge.exe	120
PID 2152 wrote to memory of 3752	2152	msedge.exe	121
PID 2152 wrote to memory of 2368	2152	msedge.exe	120
PID 2152 wrote to memory of 2368	2152	msedge.exe	120
PID 2152 wrote to memory of 3752	2152	msedge.exe	121
PID 2152 wrote to memory of 3776	2152	msedge.exe	122
PID 2152 wrote to memory of 848	2152	msedge.exe	123
PID 2152 wrote to memory of 3776	2152	msedge.exe	122
PID 2152 wrote to memory of 3776	2152	msedge.exe	122
PID 2152 wrote to memory of 848	2152	msedge.exe	123
PID 2152 wrote to memory of 848	2152	msedge.exe	123
PID 2152 wrote to memory of 208	2152	msedge.exe	124
PID 2152 wrote to memory of 4932	2152	msedge.exe	125
PID 2152 wrote to memory of 208	2152	msedge.exe	124
PID 2152 wrote to memory of 208	2152	msedge.exe	124
PID 2152 wrote to memory of 4932	2152	msedge.exe	125
PID 2152 wrote to memory of 4932	2152	msedge.exe	125
PID 2152 wrote to memory of 5612	2152	msedge.exe	128
PID 2152 wrote to memory of 5620	2152	msedge.exe	129
PID 2152 wrote to memory of 5612	2152	msedge.exe	128
PID 2152 wrote to memory of 5620	2152	msedge.exe	129
PID 2152 wrote to memory of 6108	2152	msedge.exe	135
PID 2152 wrote to memory of 2012	2152	msedge.exe	136
PID 2152 wrote to memory of 2012	2152	msedge.exe	136
PID 2152 wrote to memory of 2012	2152	msedge.exe	136
PID 2152 wrote to memory of 4052	2152	msedge.exe	142
PID 2152 wrote to memory of 4052	2152	msedge.exe	142
PID 2152 wrote to memory of 5856	2152	msedge.exe	151
PID 2152 wrote to memory of 5856	2152	msedge.exe	151
PID 2152 wrote to memory of 5268	2152	msedge.exe	144
PID 2152 wrote to memory of 5268	2152	msedge.exe	144
PID 2152 wrote to memory of 6080	2152	msedge.exe	145
PID 2152 wrote to memory of 6080	2152	msedge.exe	145
PID 2152 wrote to memory of 6104	2152	msedge.exe	146
PID 2152 wrote to memory of 6104	2152	msedge.exe	146
PID 2152 wrote to memory of 4808	2152	msedge.exe	147
PID 2152 wrote to memory of 4808	2152	msedge.exe	147
PID 2152 wrote to memory of 4168	2152	msedge.exe	148
PID 2152 wrote to memory of 5484	2152	msedge.exe	149
PID 2152 wrote to memory of 1348	2152	msedge.exe	150
PID 2152 wrote to memory of 4760	2152	msedge.exe	156
PID 2152 wrote to memory of 4760	2152	msedge.exe	156
PID 4792 wrote to memory of 5232	4792	SearchIndexer.exe	157
PID 2152 wrote to memory of 3776	2152	msedge.exe	160
PID 2152 wrote to memory of 3776	2152	msedge.exe	160
PID 2152 wrote to memory of 992	2152	msedge.exe	162
PID 2152 wrote to memory of 992	2152	msedge.exe	162
PID 2152 wrote to memory of 704	2152	msedge.exe	163
PID 2152 wrote to memory of 704	2152	msedge.exe	163
PID 2152 wrote to memory of 3104	2152	msedge.exe	164

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gomlab.com/gomplayer-media-player/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffaf633c188,0x7ffaf633c194,0x7ffaf633c1a0
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8836319370681050507,8308951523097121347,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:3
    3⤵
    - System Time Discovery
    PID:532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5657172743802268464,4195649578213896835,262144 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,14974619377405399778,5221357634634627130,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,1546590771508646493,17761712780424022539,2097152 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,3431623204126828662,16554329812896787941,2097152 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,3207674436557950396,12007275060409915737,2097152 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11578250879049701394,2736463109765771026,2097152 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,15028673706044520372,4894013835653307200,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,6623740204002546306,8639031237373494328,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,7935716277419765466,1685598958392904468,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,7935716277419765466,1685598958392904468,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6288,i,4738972222057154180,15134067649234748083,2097152 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,4061535671333282914,10740996284049762243,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,16282520457126358670,7248631860485256364,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,7224801159654566787,3670501971735194454,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,4690419855357880584,4994279174175473308,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,11375126184734220151,16938309259590120796,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
    3⤵
    PID:6104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,7811488528192798976,13747480292479584513,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,3973462479378201233,5445483153734456020,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,3839913633670358538,7029928740393860144,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,7381468486582914131,7279326522877215178,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    PID:1348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11526170953549147881,12812547690063273207,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,15763937161071625826,15353068436322677639,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,8296498489961399666,747468586787628325,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,13384402648999872935,2960966857814355922,524288 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    PID:704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6656,i,4835435663892060073,11106395533627638452,262144 --field-trial-handle=2572,i,6504604204323967901,4361432671228933808,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3104

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:764

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2132

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5044

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1272

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2308

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4092

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3540

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4284

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3028
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2937465464-4167303362-2236413517-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2937465464-4167303362-2236413517-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5232

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15a6b80faaa3791373010409b59d9af0f396531e3da1f0e46394d9cfd39e6098
MD5 729995bfb951cd8f291b9a631f4965f4
SHA1 17042fa46e467270e94b758ae5ea5223c8e215d0
SHA512 13a89314e5b22948cb056baf1aba90fb4201dedafc9083990bc0c458d02a79093f55ca57648c40a1b27812d5e246f9c88ebb5a8d4c1b2a4d9750735d424d7840
SSDEEP 49152:Xb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnOXvYMLprznyDSga9:F3q6HjBnXvYCp3nyG
TLSH
T1F3D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 f00c51fc1ed38068e75f376fc951d4ce30dda47fd1578f95a12ae028973eb660
MD5 4f8020c26d3ff289380966144e10a017
SHA1 c865113f4f1b0244bc3b7218fad9b9ac173abef1
SHA512 34dcc08982cb6d745979a5a5f0edf002bb595e8eebf29571fa227142f5b6626b3a12c44e9b834594b10dc61de2b2f024feb15cb22c67c384f93690c7be615916
SSDEEP 24576:8XYfDtczADX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:7tckXvYMLprznyDSga9
TLSH
T1C1850128B3A408F9ED27813DCCB28405EA3378954760E79B03E0996A5F377D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 d053000bc34b2955f991946fccd3ac6865ed59dfa13d4ceb569572929fe6d388
MD5 76efebc6e521ec4d96de371f3cdca681
SHA1 537894377bc0e17ea697baf77603f378fa81d84f
SHA512 379879bee73927b227ce3a70464d8c2aa770f8b24c683db731c3f98b3327b506eb5baa59c7bf4bf2cf6166341962d6a8ffa3112823b531580e8de31d84f804ba
SSDEEP 24576:i0Le5ji0hmxirMGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:iPji0AcNXvYMLprznyDSga9
TLSH
T131959E15F6788335D073C0B9C5D2A68EED72308657308ACB4286D77C7E6BAE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a9ceb597d17cec40c06407bc021db747ff2188f7c33adfaf2af7f9453797ef67
MD5 120c6920776158db4d5a32f49365bf65
SHA1 0c99865414b3150195e88c6284ee0140ffa67b22
SHA512 e18927c34d06b0b8d6289f0cbe67aa76b17961c2325f37f3d8dd3102f39dd5b11dfc57e5497fa749b888925e003d02ebc8ed22525b7d3bf070562e52add370f9
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuUX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:V/ezSC6vUzPvxHjypXvYMLprznyDSga9
TLSH
T153756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b6104f5d55755e9a88939c55f1775c1523cbc1d02f9dc1bd4534de383b6f6d37
MD5 8f38f32c0886efd5df82d217154d9369
SHA1 6c464d7e6153f811e9e6ea7df4f356728b92b8d9
SHA512 a7d03493661e5db184e0b90a379b1363a629a5b3752863f240a67119b21e6fa1f237f7f5cb77ef7fbb3d046bbe7d67a0b314a09fb8b0e2deeab52555ea42f857
SSDEEP 24576:xVbqPb88hv/l+6XX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:xVO88hXl+yXvYMLprznyDSga9
TLSH
T1B4559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 a23a5fd17da1b2cafa9bb9e873bae278a56648926aec1c1b8e6fb6e01ea533bf
MD5 36ed4a11bfb4c54c5172e5a5122eb863
SHA1 a2460b5c978792dafd16621d9c6c1048771dd556
SHA512 9166bbdfb15d41c0e5dec290367b470a5dfe044f5fc29e52c42ac06caa318cff83877706e22f1b9bff2dd4bc3e61a5efc938ef38b5f33342aebd94619548c198
SSDEEP 24576:nRaX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:gXvYMLprznyDSga9
TLSH
T193652314A63C69F7FF2B14364CF5480DA86F2EC44409AE274393BADE94FED39E446126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 59d02b04d1d4726afad51a6b4ad620858dca8911e659a836882cdfa968e0bce1
MD5 126672d0ddc3704b4c132295638f66d7
SHA1 d694cb44a8c8f9976839df42fe8ecb1b1e344d39
SHA512 9efdc7942e43dfc372a3e724d1e57ac3c3e150314e72923961b2faef8616e83c166d5af099632be4dd7ea4cef83d9cee6c5c47aa91687f546f3b452e8fc3f7b4
SSDEEP 24576:RJIUPX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:RJIUPXvYMLprznyDSga9
TLSH
T1F685CF3BEE38FCE2C67E4C795A918600E77278704B12A3CBD165830EDE275E45D7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 43a8e1cf6a30ef29d164009f227f37e64fd48c93554bde2093ac1e0c7e810e99
MD5 91597f7ac70efa7c3ed5a1a81aa84b9e
SHA1 39e9a5cc5231455885cc279f3d1bdbf865e4570b
SHA512 ebf2c3d11bf03b1edfe7d3abfbd43be040fc537fba87390e6d1dce1d6b7b896184c990c293bd7d37c6a7ba1d081264e2ecc73c35b3ef495eac0be0a098ad01c0
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:cQvGAdlCEL8c/yRNw5CEXvYCp3nyG
TLSH
T16B267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 2fc637864e1dbd904bee13c9337a379a78ce8d396ac2241088e60d53a43e4ee2
MD5 4c94c43bfb390797ab918cae9dda4e33
SHA1 02eaafd3a2cacb40e4d5a96c69e7f192d0dd11f1
SHA512 5f5da95c5b59b2539f67f2091e5a908453b1a25f1c7ade9986654f6c1555f095f7affae18bd7b6aa5c0a9ac91fde9946a71a5e6ae1c9fad0a35ebb70309e2720
SSDEEP 24576:5dewsAj9X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:nlj9XvYMLprznyDSga9
TLSH
T15685E030FE74E436C77B0CB21B76C70A586D7A604B511AC3E3E88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b8ce9824d583e980b9a6d17ff747d40eb4648f8f3cbddcf426bebd12254f7ac7
MD5 354388f79ae12f11387ddcf22173f167
SHA1 9f00fb9102ece9fe68a22f6d255a1db15b64a4a5
SHA512 b408deb4db6fe5e34cd2341b390f57941a9437a18c5bc29270eb43bc7180ce6af340c27c3a28dd42798848c2e3f72be40742687a7db3f0a92318161ce2c58379
SSDEEP 196608:GUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlTp3n:GUEtQevvqc2W1cpV2EI32Nh
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 166f04bf0a870c1ce3c9599807a37700ca6b931b9aca64dda2f50bcf592c5862
MD5 0afa2ed63c8255cbd69fb602e5ca54a6
SHA1 9c0a6b5658ead8cbab8df62f56dc45ea6b21d05a
SHA512 c26b1469214f5210433374b9dcb56ab0c6dee6ce5ab0e529b66734b95ccecb31ca1914421fc011c47c7d2b6f43ba60fe3f9b56b7c686eb9573c35845c579985c
SSDEEP 49152:SCbRquA/m2yL5zLfFiV+XenmE3/zdXvYMLprznyDSga9:3oq2VjnmQXvYCp3nyG
TLSH
T1D5D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 94b2bb1962aca40bb52297261c255400db5c4391c7394c73b213d0aa1bd275a2
MD5 bce2777bdf8e293d6a93e26eae11cc11
SHA1 9a4a06e42949bea617bc0ea6f860e32309e5a4c6
SHA512 b5ce89c9dea4ea8e34b92cb39d9551cb3e4575622819c5dfef7f27dc4a1cfbec7df07b6db97a3473c1c7dfe2162f48ed3abfa1366330beb45247a8773d5c960b
SSDEEP 24576:0AhGLJIFoiwtA5l7S53wX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:0AMyFoiq5AXvYMLprznyDSga9
TLSH
T1ED359D80E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2260D11F0E37E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 4f3dd8a4d2001541e4487b9a9c8ad62ae69036959516f9a6350e32d3b7c10192
MD5 1e9005e2cf66a43d946904782f098a70
SHA1 b33076e9dea08c96c9c33e507edd2b37005a8c20
SHA512 bdd0d68786140faecc72e25d506bf838219251ccf183189761f9be7c8dff3cc3e18e3e8d7f458714f6ff896afac34599a9b3ce77b218f56f06cbd6149ced430b
SSDEEP 24576:/wuoOWJX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:/wDOMXvYMLprznyDSga9
TLSH
T16185F10576A81CF9EA6781398997C536F7F3B8412A25DB1F03A0C65B6F37321AD1E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e3f4d525d3a5802852747dcb5314c0a000ab58adc554f193b54c025ac60dc235
MD5 69a07ce555f1292bb77de9297468a975
SHA1 a301717e7cbcec63804391d887c90107e05de19d
SHA512 0c96443650e8185fc0cc8737dbd6af51ae1da9a9b7c771556708a3be4a9b0b1600ad48fb6ba62dbd6d56403d0f3e2af171cef0273aa01bec897abf2344551e2f
SSDEEP 24576:MZu+X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:oXvYMLprznyDSga9
TLSH
T16575121932B830FAE667513DCCF14509E7763492173683CF026146AA6F7BEE56C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 780d19c6778cb3c8c416640d98a51385befe78f095cef7f79278caff9579ecfa
MD5 22d9d52eba55dfa039c2f281a8c979f8
SHA1 ce81344ccf23ded5dbb3108f4e4a8283322acfba
SHA512 2020c05b26d34691c8cd4c94c33cfacf5955850ad4a32cecbb5376e19710d5247ec2b9055c819188f5ee56ca9f323e8d9121fc6c2fcdb7d2312fd628020f2f12
SSDEEP 98304:LQRQyi36YOcPQLvw2gAf+PN37XvYCp3nyG:6QyiKayX+PNLTp3n
TLSH
T185667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 af8f31388548379b163052940205c5af1830e71ef61bb1d7e6098148c8333570
MD5 ef674bbd1a26bd3c41bb3fd640aab575
SHA1 a6072e022db2d58dea5df3d6ceee0fa0e33068f7
SHA512 20c9308fe78d0de46427de2118f36b13653ca58f0eb07322d8c112d53ecd43270ec81f64d9a05fea4cb85b18d0aaa0f38e9fab943af54e5b746ae2d0923c4d90
SSDEEP 98304:uQRQyi36YOcPQLvw2gAf+PN37XvYCp3nyG:1QyiKayX+PNLTp3n
TLSH
T11A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ea6db8ebe1e529dbb6724caac1c6dfcc43d78f898e089fd38822e278cada5341
MD5 022c933c7cbfdfbe7a515a370bb20acc
SHA1 825bf278c703af8c5e02500f8264e18e1d797d17
SHA512 388de8b0cad85fd55ee457de6684dced93d6f3ec2e1e8121c69d005d94e10e7fae393ab0d94d024858d438980c972399d47c73ba0e5525c7f0ad723466dc81b1
SSDEEP 49152:q68Qg55nhheWu7PNU3/NXvYMLprznyDSga9:YthWRc/NXvYCp3nyG
TLSH
T146B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3761c78ee5ceb5062db66f99fa8b26a28c8084836aa668ff8c918e035946a8fb
MD5 c0332908b59e2e7f244198bfe4e72fe1
SHA1 7da788cf778bdbda382b9173e736d79757a69119
SHA512 f61136891a5190f41ffd262231d98c5f86cc2d0b1848a6317ec708123782a7b393aa44ad1de1c2eec27d53288e6fee3716e7cd6179a28a6390b5ef5cf9770a4c
SSDEEP 98304:Ry5112gYy5azzVvL69nLKnhZaXvYCp3nyG:sLIHmWhYTp3n
TLSH
T105167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 92c1f0a1d2b6925e8b1414e59badff9a293fbd02afecbb62d85fe4faee6918cc
MD5 921d3b10ee1b8bcb38c34d2edfaaac35
SHA1 0e6d37b26ee8c26221ab72cc7dbe6ab3eefd8bdc
SHA512 369b5cd3b83d3665302194f5755d736469c0c0ead29221ea35d49a9edcb5f90dd28ee43e2580ed5d7ddee80a8d28aeca6dd0d36fa0e632578436b199e71648a6
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTXvYMLprznyDSga9:Nu6JmVxd2dTXvYCp3nyG
TLSH
T106D59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eafd418083de6c8486bea4b5f5bee78a5bb4de8c46454e3524e903328e808c6a
MD5 166750fd7f30f2d64aee86742b6475d5
SHA1 786fd3e176c430b3fd84451825fd95def3127ba3
SHA512 2c83d2c77ea7160487f1281ab528f8709b07e3ad55f6122d8a12460a067c88a78f7edf0181e85c26ea42911f90418b6d4b4b258db9d07e8097ba57af1d6cbc73
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xvXvYMLprznyDSga9:VmifPbRQXvYCp3nyG
TLSH
T18DB5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2809dd08b20ca1581c7d6add89c6e2cef25e27aa54a2ad4de35bc6c49dfd2f74
MD5 76a156cb3dfe9e9ad31575773ecfb763
SHA1 946c2b831bc92c39725f59fb3be274ec9ec14b35
SHA512 c2beedd2ab8415533bea78bf1e574153e4cb9f7854adbe6cd1720480eff66f13cd73081b284e47941cb3a99315432c7689192cfe6f368d84a81c98a62d1aa669
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHq+XvYMLprznyDSga9:G5dKTi61+XvYCp3nyG
TLSH
T159C5BF03F2E941E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5d1dc18b5604c32d8a0d601eaaaf17d5fc0def30321dc38dbceff11b2071f5c1
MD5 a21467325b023bb222554b5b8453dca8
SHA1 60a3b39ad59f2fe9acfb7e7735f9f52158e9b043
SHA512 d3584c6e5e2396222c47c4869b136191dac2ac9a2e4c462231aae14bde7aafdf62ba674bf18277058a641357f1e42964efed6d183bf9c3a567b75294439704ef
SSDEEP 49152:whtSn8EApI0figngiDn0AP5wDXvYMLprznyDSga9:hX2iyphsXvYCp3nyG
TLSH
T17995BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 4c3b3fc6022bdf2c804e6de5ea534187f413e774a262035046900a1a32c87ea3
MD5 507256a72c2cdf023bfce9dc4d540030
SHA1 ea7b9a05293a7d358172d660b21114ded0e20fd2
SHA512 95cdab2c2b041b310f98557508be9e60afc985dc20aa2a1393944dcad15c00ea362a20fe7267c92bf136ce8acf3c26a7c86e6e631e85d0ce6015dc417377219e
SSDEEP 12288:/yLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:/yX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C7652304B43D69FBFF1650768CF0440DE86F3ACA840A5A2B5393A59FA6FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 8daf3eb5fe3e514a740ac5cbc79edc393b53a415545cd3014f328e8dc824ba4b
MD5 8b234a81137ed877fbd08704b7a2a4b0
SHA1 4c2b8d10e9338e42ae4637aaace0632c44e91dea
SHA512 685a8e33e0ea2366628500c78d3b5e2196be21efe4759418c0eaf83c2bd21c9206c72b6cf73da8e655db06fe1edc230aadbf3a74d4d783032c757ebe36c57d50
SSDEEP 12288:9RLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:9RX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1F6652314B43D69FBFF1A50368CF0440DE86F3ACA440A9A2B5393A59FA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 d1349a6ac1c9edcec8a410693a42d5ade1114e48d4d8065b0aab0e910c1eb613
MD5 8b2e0436c9cb0cf4cc911ceda5f8c733
SHA1 434d7c1ae84d69636a61aa529e14a4b091601ba8
SHA512 cc20baba926fa7f11e3143c74895942d3f1a348c1e6bbf32bedb137b97c8ab983973020e00c57b07ffa2ac229465e12e32d9e945107ae9cad950c64467af1c0c
SSDEEP 12288:6nLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:6nX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1B9652314B43D69FBFF1A50368CF1040DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d1e324413fc051d37dc7c0058690cd73482f4ce7e7c1389490f12064521bbcea
MD5 4d84142b07dad44175f3d7e1dad73f72
SHA1 8d3d4d206c5253642e7b6a20f824a3f94485e520
SHA512 caaba415f1853642db4320e4c42566780ca696ba3b8acc34822e8aa4a3dcf3566ef4cbd02d31eeb57e3b669690833ae4868068fab62afc2ad39d8efb2e7b0a60
SSDEEP 12288:JVQLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:MX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1DF652304763D15F7FF26913ACCF14409E4BE7DC586269BAF4382099E5EFEBA87805224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 902e13d90719261ed70b964a7891f510ab9b15d86e209f03a2f53fa0426a0356
MD5 34021019d1d51505da129e10312092d0
SHA1 5645c0cb06516dd2044ad7d4a7f5b2cc671cb6e3
SHA512 88a3a1de90a32c5f3f5f1157fea5a48e9c1d6427517b8ceb7a57d5e53f8457d153aabab9892531b99c2da5f84a9c6da3d48c09cb4027f2e5285b14c4a71493a4
SSDEEP 12288:/4LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:/4X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T18B652304B43D69FBFF1A50368CF1440DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 31a36756a241d5ff01079018553c64a619f7265c5e99e3e2850c577e6702318c
MD5 9d784ec86f7c1b89abaa8ddf06f3ea0b
SHA1 5b61c786618ca0deb78a09e852b464d2ab2f8a3d
SHA512 a3bdf3949a058864e24e706049154cbef34fe9e9b8a573546fb39076ae89ca21e1d4b69fca18b7befdfc3365531726a4a1af7304a1bbff0adce5675fb3cd3dd4
SSDEEP 12288:SVLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:SVX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1D9652314B43D69FBFF1A50368CF0440DE86F3ACA840A9A2B5393959FA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5fc866ba4866b375a9919890844c1c8c4a1ad024e21d997afbd5ab093bbe0bf1
MD5 4faa7ad7548535e36010534d3adcdf10
SHA1 299d58bc2e782520b23e30abd7c50abd96f81348
SHA512 2771e724416db2a036e7e1923f7b0bd5c9bd463b6562d4679fed9fa192b766109967bb960f527afba716b1c7ff8f113c3df197f683831f52051b1a13bfa9a372
SSDEEP 12288:nZLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:nZX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1E5652314B53D69FBFF1A50768CF0440CE86F3ACA840A9A2B5393959FA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 4224a30435acac491ce763ea2233aaaf309748f3aa260e082a001a09c2a9eb2c
MD5 315c34a71bb9e84a5345611829a43a89
SHA1 d94f2329635ce70680d94364b05ad6b8e4e3706b
SHA512 4a858748bd740769d51ba08b66680e6325d5c50759ac4b9e65fb6559a4e4f11d8523260a16f053fb5c3b361fddaeee39b04da3ac04dd16ae89277d48b1195d97
SSDEEP 24576:nZMSzFVSOxX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:nZMSzfFXvYMLprznyDSga9
TLSH
T12E850154B3601CF9ED27813ECC65890AD6B27C5A0B60CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 747f6bb18698c02a1d5ad3b1b17fdb9885fc377b268e765bedf403a94671392e
MD5 5cd16cde28d48843ba5ae231c6135293
SHA1 965781c005c9158f41c2841efcd9fd18515b3b68
SHA512 0ee8953f90320d0a75785db2b0a0d7abab28a36115ad5d61ce0e384d91994321dad87f733d58ece302f65c20ccabef995b056d2d95609e5d0f8226d7ceed40c9
SSDEEP 12288:ZuLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:ZuX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T161652304B43D69FBFF1A50368CF0440DE86F3ACA440AAA6B53D3959EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 f2c9400f1fa463ff47580e50c30ef5332906fc84d3ae875948daaf50a0e30fd9
MD5 f933b2f2915886882268301d6b199601
SHA1 906e40945d02d4a5ee9dc50dc40c63bc6d0e4f30
SHA512 46f2abbb5e4c1d75c8fac15c3678fdd3c6d317fd80f89545b534f9fb1242b735bf7e7092c80bb9b24b05b99cbdb67f908b32663205df0b18628b323952f579cf
SSDEEP 12288:XKLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:XKX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T193652314B43D59FBFF1650364CF0440DE86F3ACA840AAA6B5393959FA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 a9baa5ad6e9de08ffc6c1235b41b2c46e98cd0c899c085af48c0d6f372e1e12b
MD5 656a5bdbbfa78c0b2fadffdf46168fac
SHA1 1f4bb6b6949fa684f5976d7561cc9003aacc8dc6
SHA512 95d64c889105efb84486ae2310a07972d4c2d3038c243df74d9c7fc5546dae221a3ec35c3bf79069e5e8e937cfa4dde28a06d0f68ff2c91f488409bc87cc5f15
SSDEEP 24576:LzytX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:LsXvYMLprznyDSga9
TLSH
T10D750207737530F9E6379139CCA10905F776787647249BAF13A047BB2E7B6A0AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 098f176d263ca53c9d5741d4dfcd6be31eb689ddcaa9cb5f0920eabc2d49c95d
MD5 bd4d827dc8a58e0afe165bcd481d8c1f
SHA1 d2daef24b8feb1d133a887497bf5235a0081a0c4
SHA512 4ffd75b15666a1d977c0fb39e04a01767582d33cd9da20bd4c2591b6f81f167347726492240a5784779ca7f14417177f0cdb18d96931e5c014c4e56162a21856
SSDEEP 12288:yuLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:yuX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1FD652314B43D69FBFF1A50368CF0440DE86F3ACA440AAA6B53D3959EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 14f18f90f386706c43edd711897c7f0ece200eea5aeb4db94379d49a034f6398
MD5 db31c918eafaa787df9d4cba403339cc
SHA1 36abadb943a0e1633280a98155fa870ba9b4b071
SHA512 ddc75c8d41e93d2231923eb18d0978d8bca50be0320ca08d316887b52fe02cd7a93f2c4d5f279842d27dfc30bd945baf094c99afdbd750c4df14db84e1b7e45f
SSDEEP 12288:4uLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:4uX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T14B652314B43D69FBFF1A50368CF0440DE86F3ACA440AAA6B53D3959EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 09d4b43e68f08d61f861401bbe472609dc07beda0b4777dd3b951985e0bd39db
MD5 24c5e6743a718449980a77ae9b4af92f
SHA1 1ef4445cc58705d67fcd133930ef8ae5996ed093
SHA512 8494d10089471225868f00bc977a597753e8e053ca74206054624bf71461daa32eb7e4a5182ae72efd6fe280a405622a1a224815ea0d79cf91f48f2c65b203fa
SSDEEP 24576:vzytX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:vsXvYMLprznyDSga9
TLSH
T153750207737530F9E6379139CCA10905F776787647249BAF13A047BB2E7B6A0AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 24b2b18ebc88f5c9a7548f3646518c6cc3f556dec5386d92ada9d6b6cb21aed9
MD5 1aac8dd08003a7d41a438aab5416d6d8
SHA1 559d6b789b206b498c6402116af06ff06971c286
SHA512 3b26a2bf5d09663cad460f6fd470ec758003afad1a9eabded90c563205940ede42ae285c897dbe958ef92a08b9e5c8ba5dd25f8dbb91b2e077bcc986b06e612e
SSDEEP 24576:JcP4mcvIjkGOxhKP2l71nNKbrh/8KBWX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:+P4m4IpOO67W8KEXvYMLprznyDSga9
TLSH
T1C365BE2DABDC0096D0BB913885658A4AFAB1742A1F3286CF1160933D7F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2152_1547024942\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2152_1684665051\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2152_2011078793\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 fe0b01205398d5f5dd175e36072b2adfbc032044fef8a789d19b9b56cf9f21bf
MD5 6e8e56dcdb690445ff37de0ab4994a88
SHA1 2bf24aca870859e924d3e744300297603dd56863
SHA512 f89b7590a838f751687b483b51d452ac2a8def9efabf8b0670382d82c987d0e447cb711e087241a079ffff36b2c8e68ba010036a70de4b172dc7250e00e09d44
SSDEEP 12288:tNsf+LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:C+X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C475F109E26812E9D52E6139CB914A05F7373C6583E1D3CB53D0F57E1F7AAA46CDA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12104dd3c2fda03eed8e9fe97d1c8c331237df73b825255f2c8a4424f9eee8fc
MD5 0272cacbbb6ed8ce74e6c664a085e187
SHA1 e18e3d395cae9ca66345f804f048f752074420a7
SHA512 d7df299a22bf1ed1d6757011261fcc585bb9aee7db699aa7f37cf58e7bd5302ee7ae45218f61624dc842a99548b44160f0e1bd6af1382db157a77eea1ddef3c1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 34d1dd3b8d210edd3f8c9c2b3e7711c0469eebeda6c979696291601993332835
MD5 72abd75e2d5aea6e5fd963ede4f009f1
SHA1 f203aa9b15cccf8cdc2206a8c26be0eddd830f4e
SHA512 afeda348b122b9107e4764485ea72b0947f3a15c2d32df79232a84d7078262bde43744268f6cc4bba812de5a33f2c202d46d26488124b1cceb50bee8968a06ac
SSDEEP 96:lnMKFDIMl7LV+0gUV0qdWnuwzfEFdZ/tCK00EMdRt:FLUBKWvzcFdZ/tCK00d
TLSH
T171919214C6583CE1E7201AB9EDF1B17430B299C44A53DEE1B22048FF670ABD94C2F46B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d6f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d6f2.TMP
Size 3KB
SHA256 0a257fcda82663ecfce46e44570bd56198b08b38990ddc81d0d859b1333fc93e
MD5 799b553fde2c21a6fa207c1d63227bc9
SHA1 02a5adc44e9ae2a112fdb59b3a876ad620fc8912
SHA512 bf646692dab5f9cdc194244867aca10e387b186c921d0ddaf9ecdb63c79a87a69fe4c261d5669ec24dc12ac66bed15c32d5cc6eed06b757c253234d4babcc867
TLSH
T126718F19C64D0C91E7601CFAEEF2B27130B284C809A3CED1A61049FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

649244d8-a2a8-4813-9529-5eb296434c95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\649244d8-a2a8-4813-9529-5eb296434c95.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 18b15f8baac07306722c38761da900c6065017a3f6fc97071142ca3fc6657cf6
MD5 399f5fd8739091273976267a00dac9ca
SHA1 2f2d85d595822b03398be3770bed201b1ac8e369
SHA512 aa2843400d582031a965d5bfc216a84f626a2912b9b502f08edf9cb30fd701252e4414bf3e9eb6b2c914d734e7a47a4aa2cd4f9728f82779c1f21d4cfcec53b4
SSDEEP 192:DFOAae3evg+o/upgemeE/Y+Dy4DVRIDMlTHgYDxSoiyvY850SNXCxn2o461QHrfM:DFOAae3evg+o/upgemeE/Y+Dy4DVRIw8
TLSH
T15A429CFB83E5862DD91156F09B28AE1BCF190514532D3D3AC9E4BE4AD3E2C72E101B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 02b44b6da1fb8cfcd8198d6294e8b0d7b02d1e5b398fda7b3bfd290467a03ed8
MD5 1c8aff688725676bc40703e06f292cbd
SHA1 bf6a6a7e956537157c69714be987e60cebb29e17
SHA512 03403e54ccb81550c36ee8e34b91e84be1022b2699d7e75a9e107a5cd6b5012d696763777dfc41947af22af1b96f1b66139f4ca78c93b05d8aae825d71f4de85
SSDEEP 192:sxZz/yM/jK1Ml8Ms5/f4sYSqHEdp8THW6+WN4An/rIu6UV7S6N9IaXlVIVIszPC4:sxZz5E5/f4sVReHbf/rZ5qVrmO
TLSH
T17752C652A9346D778DDBD229F541BB27D6FA046396940E94AEFCCA1C00E7AED3103C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f93458cc4811f7efcfae43b05d8cd804d475b0a14b4eeb7777b74d795b8e0754
MD5 ef63e6bd9c74d33ddb72b14c004872ca
SHA1 a76d19ba410c02dac5f6316a08e572ca4aed0302
SHA512 d19f0510fc11bdede8062bc7759938422b0021dd861b13bb44a915c09202da75e4870cd53731685699d12ff5058c61b108f02057b4ba3371a0c7fd6759be5dc6
SSDEEP 192:sxZz/yM/jK1Ml8Ms5/f4s/SqHIdp8THW6+WN4An/3I6Iv965BITV7S6N9IiacVXD:sxZz7E5/f4safeHbf/3VK9+qVxmE
TLSH
T18572D592B5346E7B8DDAD225F544B727D6FA0463D6940E90AEFCDA2C00D7AED7002C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0f17e23b296ee9aa846c5aa047490592033b6864aead16309203b5e344015343
MD5 4e89835f6c7cc67947aa1bf90be08bab
SHA1 4af8e9ff59569dfa76fa8ce28f8ac6240ab3dbe7
SHA512 e1c2aff69e507558c8e0dc722d5a93343c86422f463ff4cc1729be43ad282900a521613f2ca9bf1f668f8fbd471bdd3c530b5153745f82f3f7fde62145ac815d
SSDEEP 768:KMs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNFrotG:KMs6pD1WvxzWju1jahILIsN+tG
TLSH
T196D2FA3B680CCB7E4F841E5CEC2A6E967DD801CBAB98895447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a5ee85b9a0aa9c0d80fba167fefb19febcf5fe2e9fe13f560303eba24c4f7314
MD5 6fbdb735f5940727c2afc048750a8190
SHA1 a9a0f3b2278d42192b24247b24ae6b841db47d82
SHA512 9e82787e15016673d44a381c5f8fc663567f02ce9468d797c3eb178cdc4fbb49a9e8268e4e2ee80abe3d20e122aa42bc754d304c510a22ed2b179355f2052925
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wt:KUAAKtePiwQKFWvC6EKfKuurmKA8u
TLSH
T1DAC10C1271BB0A033D7E1B0CA265872A97427263305CA92B3BED44754DAAE3D4DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593d8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593d8c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 4d726635e57eeb16c3ed0876ad0abc986ecec951d4bd428d20ec78fcdcccf3c2
MD5 af4d033f2412a3299487ec32710d747a
SHA1 de27dbd47eea5e38781e6fb04d4a644c109c45b2
SHA512 a32467e2100a132581212e154bc629aea3e8eabf256a3626b26dd18bbbd5ee0b1cc18b34c0b461363f9a6cdd1098e55411e1108c2b8cdd22791fee166a076447
SSDEEP 192:uuZLsN6UrQ7AYnw7+3vS1QmiU1sR+4atb0j+Fd/cQzDRHLM9FqBLU8:nFsN6UriAYnjiSha99d/VfS9UU8
TLSH
T1DA3209356C789C634AA2A145F5473653AFB910B79D8A2F94E5EC8F0C00D77AC235AC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c7544748123c6462c1ad4688fd57d57cfdb51bc768586149c21127860130e991
MD5 225bda34042855143f2ed65a252b9a3c
SHA1 351be5ff5f66c7adb37cb0ee057887d14bc28f94
SHA512 5dc34b69208f13541eaabb8b2b7bc9eddfdec48e482b07b8eaf67e11fb6c4513be4ae0e2e5d1254bf5f006fb1eebc36e132e8fdb569242f5d31fa7c624922189
SSDEEP 384:n5ZcIhsN6U+iAYnjiSha99d/VfS9UBeRs9JKgqijUdG:Rhq990fzS9UTjKgqmUdG
TLSH
T1DC927C305C396C7385F6B645F98626179FFC2077EA955F90E1EC9F0C0096AAC231AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 abd30aefcaac32851de891d50d06823b4c3fd2ff362c0165e46377feefe346b0
MD5 1c27387740e317690800807e84c3f385
SHA1 0de06fee29b97d86bd1f4747accc6de28876383b
SHA512 46f86c84a35d8e791bd2af0908b9a4abf848640cbbfea58dee635bc21faa1cd047a76f758cadb0d3d259fac453456d7d333a9850a949a15c72e2fdc0e32c9077
SSDEEP 192:uONo6O7+3iQmiUyfSTttb0j+Fd/cQzDR8cN9FqBLU6:uONo60/Tt99d/VfT9UU6
TLSH
T1731209346C7CACA74AA2B105F5C726539FA910B7DD8A6F41E5E85F0C00D7AAC274AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a76a711311b1b21ce09edd3bfa376caad8c42b370f23a7553242902065135079
MD5 329bcaec299d803f05e71a18fd60573c
SHA1 4d83239ee622f7dddff0fd8b8d59975b2ed52965
SHA512 54b8da6c3b579dde569427df23c05199c215bb58bb2128418a7d430b6e69fbd7291854d1cb7d17717b56d287c2da1229c93b612617bacb10346f55c5aa8f6ba2
SSDEEP 384:noiFiZcIyzsNf8TUNTUlIl+iAYnjiSh9DfcK99d/VfR9UBeRs9JKgqijUdG:zFQaawgt990KfzR9UTjKgqmUdG
TLSH
T1FAC24A35D8A8CE7BA9F7A7C1F64676578EF810A389D99ED0E5D89E0C00835ED130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ed577e7ffc005801eed749df7419706bae545e82e401734c1213db426e6f074
MD5 d7353907fe796fba679e618969e018a8
SHA1 b33373640f3a1fd4f8178dd46a4709010c46060b
SHA512 3846b1af2582f1098c2dab7dfe84d0d3e240ae9457582eb2facd4d76911f7908a946af8e8095b1115949df9c3959f77404565f94293c9c2ce58dc05398af93e6
SSDEEP 192:qONt6O7+3hQmiUyuSGttb0j+Fd/9UgG976W8rU6:qONt61UGt99d/9a97t8rU6
TLSH
T12902D7356C786CB78EB2AD49F58727235FA5117BE9A62F81D6E81E0C00D766C2343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 92ab1394e102ac92fb586415625762a28a831c1e213df61748594259671685b0
MD5 1819dc19276a15aafef73353e20f0ddc
SHA1 cafabecd491230f863848a5d3f566e9b15b1e461
SHA512 47846226c1b839f554e33a28efe61e8c3ea42dbfe064e4c9b0acb678416493e0746aaab637a7502c44cb130c9c8764b9e87ef5e5f9eef3dd7b26d2732489bad7
SSDEEP 192:zrsN6UaQ7AYnw7+3vS1QmiU1SP+Zatb0j+Fd/cQzDRHcM9FqBLU8:zrsN6UaiAYnjig0a99d/VfD9UU8
TLSH
T1D03208356C78AC634AB2A145F58736639FBD1077DD8A6F94E5E88F0C00D76AC234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

20413e36-487b-417e-898e-fe080891dee4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\20413e36-487b-417e-898e-fe080891dee4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e553ae4e-136b-49e1-be07-ea4497d260c4.tmp

Path C:\Users\Admin\AppData\Local\Temp\e553ae4e-136b-49e1-be07-ea4497d260c4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

4b26781f-6e53-4820-a31c-b74a6dba15e1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2152_1920607439\4b26781f-6e53-4820-a31c-b74a6dba15e1.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca7e8bc-7744-4dba-b041-fa280c10fb39.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2152_923658874\6ca7e8bc-7744-4dba-b041-fa280c10fb39.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2152_923658874\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 4336ddb5bcf0e5ffe69cabc54a5655f4038da688d06756787341802be94f15a5
MD5 d5527bab13c9237f2f39f56481cdfb9c
SHA1 28e79c98d82692a51c88f05446bfac9c3ef8ca14
SHA512 c420157b0a88a099c209ea1cebca6a5e918897fc34d5d85311b8e3615f1fc5f8206557a73ace43fccd854df3b74ec19db27cff0dd4c81e3ba734b48ac0adba46
SSDEEP 12288:1eLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAjj:1eX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1D1652314F63C6DBBFF3A64314CF1840C782F3BD449099A5B6382669EA5FED78AC42116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 8364e018f09fbd4acc944fa854cb69c971954f0d0a65ef4945aa0751c7b6f36f
MD5 651365dd6969ccde60273609763a7df1
SHA1 b97cf477ba84345ec86e4210e8b4e3251c4a8441
SHA512 6a0a14c424af14f58c44b651818c8defac4cd4d1e6db2984f9bb6262d1f2f2a9dbaf1f5de28cb2ee4df8e36cd0cd9dc5178dab2accf9c2f6e95406293c2f5729
SSDEEP 49152:wa0h2GEkuAe73q3pp46zwwQ4XvYMLprznyDSga9:wa0hNYG4JwlXvYCp3nyG
TLSH
T1AE85AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1191853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 83c7cf6b46d7248c18a81c2a2e0ca6135b5e2a5f28200f815318925474133533
MD5 33d25503e7529bc16b50b03acc7d62de
SHA1 ceb5e46ef6567e700d40972273e086804b60879c
SHA512 afe6a0ff49d3a27592916030c97a7350bc07f2da11de07e6b367c85fa1bba1c33f94fa7c9855a757ebe581035619cddc5288abde15518c20065ab32d34c3c6bc
SSDEEP 24576:ohbHjPhX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:ohbHjZXvYMLprznyDSga9
TLSH
T11675023D26BC20E9F632A17D89A1450AD732B865071193EF13D282BE4F7BEE85C35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4ca399f752b56b999f4a91c8dfa5372a1e8b05946fce32b20c868db2e5606582
MD5 14b0ccf0c8c311a049c64a39c251f0e1
SHA1 54192c702908267084bcf88cfb5c4a9ac6d05d30
SHA512 9a75cb0a44a05f5daa5d182aaa13704d9d80677a80bdc7af5a91aca4cc9b363370d3bec5577d2ee6d7f1aa966d771956310fd37b0cd2e08e047c9d8ae4dde47a
SSDEEP 24576:z3YgnJcRTk4yti+R5dBR/JX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:zIgnaTk46pBR/JXvYMLprznyDSga9
TLSH
T13145BF2DF2B910B9D8AAD136450147B5FB71782D1F209ACB0170C538AF1AEE89E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 4acfe2b3b222afd97f4c0a3a09d1cd8008ebb18e231ed175a7b15db24575fac3
MD5 15887f9b838bbc00eebc14c33ff1f8e1
SHA1 f4ea9f79983631c22a1c910f4d03e6c7cc612170
SHA512 5eae490a9b94769d00eaa8782496738e936eb1a7b295bacd1d2aa81bc0e260efb9faffd5e645878b77c55c96f12605b9efecd784573c6c9e10c4840efdd548bb
SSDEEP 12288:96LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:96X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T10A652304B13D69FBFF2A50764CF1440CA85E3BC4070A5BE71293A59EA6FFEFA6856110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4959a6f3480161dea45693e101016291b4a9ef3c1fc54e7c97c9a59d3ff7a631
MD5 2a30e337db58843c38a7da6fd1d3f118
SHA1 7c3d7d036fa5a34306e58adb95c6b1f5213da435
SHA512 7b22dc48f23acb74a2bf07d9bd61e7dac4435bd2d108f25c91c68b7301570068e42119c4dde60440db005db12815818e7c852ac39b56c50905043f3d1e957e63
SSDEEP 24576:upL3UTDX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:upL3UPXvYMLprznyDSga9
TLSH
T1B595F114F7A804F9ED2B913CC8B28916E672749D0724E7DF03A94A6A1F637E54E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f1d467f4c0762164a8eaebd7793a1d0e4dcce62cec0ff5b09b4135ec50dfd715
MD5 e602242ae877ab54047312014505f769
SHA1 8a4d8a760158f3aa15ef9e4f9df87a7a2dea3330
SHA512 173e9a4cd5c0a5a50b32b435c4324af0d32b4d8fab07104dba73f3cfc1a510b6e90d62d5cc7a0c4a7c0c2402ed91825404dc7637411a2381dfff3554f767a86f
SSDEEP 24576:FOvX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:FOvXvYMLprznyDSga9
TLSH
T1F175021936BC20F5E636A13D8992420DD77678A5071257EF02D081BE5FBBFF86C3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6de4334d017e550561e4a97fa0878599db39907924592ca1e4bc75dd0f6a7ff7
MD5 f0b408fc3f3229b4472631575579710a
SHA1 e5929ee85b15b41975349b55b681acbf5b3feb3b
SHA512 65c1513d51e440dd588eb529763c16b48aff7df24bd5ed436148939c389df1a482bc61f40d7892e99d75edd9edcc8620e2ee583e22f5ad2ed73a9f6bcfad97fa
SSDEEP 24576:M7NM9YqZqmWMUkPjZM48Mv6bEhsuX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:M7cBWMpPjN8DbEhBXvYMLprznyDSga9
TLSH
T1AA659E2E6BAC81E5D577D13DC9E28205F6B2B4611B318ACB1162833E6F37AF44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d8a55c90dbbe28d6f5fe96d8b52b535a3969bceadca9cb5688e6b6259378fffd
MD5 1402d9f5af3b6d16421bbd7818019f85
SHA1 353b7d78bf65e7553edefb1d1131fe70bb8b31d1
SHA512 0b784bb2fe07ed8e8d8db80834e1ab67d24c652d7b9d6713ef7036e35a5b58394f99dc545a00c5d83544d9b5837487ad367f50315653a2fdd42ad2c1e3216431
SSDEEP 49152:1F2YuHNETovAvNYf8kmOXvYMLprznyDSga9:Q6BCf8kvXvYCp3nyG
TLSH
T119857D2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF45D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 72f74e62edd3e22395b41bce5aa7bdc2f3ab225283a2ad7b55c001d9330901a7
MD5 5f15a859faf4e8aecb971fc86b5afb7f
SHA1 d1c84820b45ecbd86960197fa1d639ce806999b6
SHA512 78bc212a591ebfa74c604f8bfb3e9dc604ffeed1d2d372561d7ea9f2b96270f6c19d8b2ba281b6f75c96719e3c89d24716ab2aa73eda1b4e08d089784dfeac6d
SSDEEP 24576:kAFs06+Omlf3NXEbTobX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:pFs060lVXuYXvYMLprznyDSga9
TLSH
T12B65AF2F62AC00D5D07ED17E8997C91AF6B1746307255ACB0260867E7F6BEF81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 21110e026daed06e2a05377816d14ab81f3f99d715666d98cd4eb32dc1a3e9f3
MD5 879d99d41f080a7a34730b4d4724935d
SHA1 89264fa0dbf1d2e8596811b8dddb867ad5a16a4f
SHA512 573ad6c2ec8c7e6d5bde6a7bb7aead9998726d6405a6eadd69960bbe9c4bf5b182cbc8d996141945ebbbfd449f6f78518e4273208d6725af0ae3b79cee2ecfd0
SSDEEP 24576:eJnJ5D3WXYX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:eJnJ5DGXYXvYMLprznyDSga9
TLSH
T12E85D02CD2A810F8E477C274819A1B46FE72387D2F226AC724B4D5357F16EE0A979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f59328ded3fc67b17d1ca75a400c65231a9e2c3810334ec8f1532a3d742be9d9
MD5 ae6fac3707b54985da066184bf79bbf0
SHA1 5a461ca95aa291541f0d7400adf9a30009009e34
SHA512 82db367d624b95b072ce8288809e68700773847196fa49e4f055c94744985555de5186385db855de32b9725f769ad61c2296f9d206d1b25ce85264dee0962e9f
SSDEEP 49152:og06DIKdwc+eQnSt65aVyXvYMLprznyDSga9:pcXvYCp3nyG
TLSH
T103956C15B7EA5294E9B3CAB1C962A1169B327C509B34F7DF0AC0C92E1E33BD1D835B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 9f5f154dcb65bf9e1dcdec88592598825cb6f35f8484a19febf9aca195817b70
MD5 4abd6931a3bf25d5b7de4eab1f7c97a1
SHA1 8819073684070bb5c09b892242ec43ddbe6fc9bb
SHA512 616f224052de7aa2856a319b537db8b1dd5b4c302fadf7c60bac9eaa80602a414edeeff878e23d88fb3ea91f30a5090c110ee34d90347bc377c036d826ba0b20
SSDEEP 24576:tn0X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:tn0XvYMLprznyDSga9
TLSH
T15775021D777C70EAE626903D88A18509D376F0A51B1267EF12D2C27E4E7BEF92C39610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.6MB
SHA256 707c2265647ef383c805de3d17a8007e0e13b6e5409810b0c239aa8c7ec22022
MD5 491f746e9117ace18fccd4663641bfc9
SHA1 90bf7e2d2ed736da7d4cc4bb0b89a92597c1e6e2
SHA512 aa23d8e914920ae781271d6501a7f173fd7a7ac922e04ac966514e3a0dba82700e8fec4eda70b6d0c6fd7f0db58f2354d216cfcbf0a7726eb9f8927958a5f188
SSDEEP 24576:AIyRX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:AIoXvYMLprznyDSga9
TLSH
T153751204736864E9EB3A01398DB24148993ABC604F1197EF52D1E63FAE7BFE4AC31711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 d85b559f9825a5e80a8cc989e25775faacce4894e2f5ba1f9cd36d3568c133b2
MD5 890b5eaf5c781aafa87159e3acba6043
SHA1 343d8c6a91dd025b25a80937db0c40f27e81f624
SHA512 c67b1e64db7bc038f50657868affd67e3bc2b74b6f5d8e63d0f3a34533c51e3fe3cbe0881f0320fa1217d6ab2f9c6bc4c4e9d32820f127da5d8742bdc20c7ed1
SSDEEP 12288:qyfLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:zfX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1D8652318713D79FBFF2650364CF04908A46E36A407096AFF12D2E5BEDAFFEA96452110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 27c6fe2e4512aa0c64bdb94d7457efb2d2248852f7ee6437c4179b412bc590b5
MD5 c1146efa158b415edf29ce7bc136f0c2
SHA1 82dd5cbd1183b26e0f870201e14bc42dc211a2c6
SHA512 8259907c16a37683aba75037c5b9b20cacdefd27586959128a1a381052bee79905d80b0469d56be5ce3c723e811001723b9ec9fbc6742f98fecdeffe3de97d44
SSDEEP 24576:UQ9MxZKdcz9dw3mX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:UVKZmXvYMLprznyDSga9
TLSH
T195557C2DABF9059AE177D23594A250C3A633B4311B35D6CF2448D03D4DBBEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 fb182026bacc11ff4a7ce87ab0096e6d5e7b2de8e94ab0b581e365272c05937a
MD5 f5337236994c008822663586004b14cd
SHA1 80b5b6e5a0fd1d136bb8fd81774af75a7faf39d0
SHA512 8015d086ccd6cbb94f2db781715c98bf5f62df7039f1dba524103e3a7e3fb8b3cf16759dd335870553c8d1b63eaa2a41b838479c54c9684a467a0ccf2544f0d9
SSDEEP 24576:QyocDAp9X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:docDAp9XvYMLprznyDSga9
TLSH
T17085E01FB76D40E2E136813C89858649E773B0705B2257DB5292C33E8E7BAE9BC35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 55b902a88c4c818a8964e38a162af9ce7e5e4af3375f59339c35936c1ac1d6c0
MD5 b76076a02982708f330f56369b0e623e
SHA1 d55670930c86b99be84c255ce46e27e131cbca67
SHA512 9e1337fe74783814f88fe8266638b30b9c339e90dacccc08e63612f3031100d99db976a876035a240fdf819356d0808bff2b01fac6b4836e2c42c99f5ea8f4bf
SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK9XvYMLprznyDSga9:X0zuNIDXvYCp3nyG
TLSH
T111A57B3DA2BC00A9D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 18fe3a6e3409fcf79856919546c994f5379168c259887ccdd2569453adbeab6e
MD5 b440588a20ffe38a76392b13ffc67fd5
SHA1 1ad54d3e0ad173446ee6df1a1f6ed66f25242ca3
SHA512 7fc9f1fe60ccc680358d55157ae1413bfada6cc94db12ad07f65980b378600a6e01a2bc110306f3f6910459c09cf844027954f23c31bd8d375fb880d90242ec9
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYtjMqb0X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:ITDxR+N5YzTfjMPXvYMLprznyDSga9
TLSH
T1C855B02EA7F815E9D17EC5798A23C506FA727861033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.7MB
SHA256 7c8ee8c2607888ded20e7d91cdbe86803d6abbfc385a9bc5114bfdd7c4fe449e
MD5 497a2a80707309d0b760f38f77a9e686
SHA1 a368f3e9fe0c96e1a7844d35cf8f5a31a0164418
SHA512 5ccd7b9a3dac2d5cfeaea548230add42f62e3c0dae4bb5be2023e34d7f7ac8cd86ca200a6a15c5e30bc0a6e77e6b67b89e0902358da7fa3590d12ea776a307ee
SSDEEP 24576:4TMdOz0FFS+imSLQX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:Q0K+imSLQXvYMLprznyDSga9
TLSH
T15D85E13EA36D14F5E53BC17D9A538906E57234610322A6DB06D0C1BD2FABFE4793AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.5MB
SHA256 e5a6eb315d641cd73e32167a3c760e5ed80d023a3e6215e36b4f5dc43b31e741
MD5 3bb56bb3523393afa8b73920c58f247e
SHA1 f8e1ba46a2fb1d8ab571f526033f9dcecdb1aa42
SHA512 e115885aa46ddb6c4ced34ff122b8317a473a52905caa9c8d112d5755119ce25d867c7485b8e21b5fcea58db1ea8ba442a1d792c7d53cc42ed5a5747b20fb4cb
SSDEEP 12288:Z4KDLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:dDX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T19575120C73FC34E5FA3291358DB601099575B8A503156AFF22D1C5BE8F7BAE8A839712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/764-105-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/764-11-0x0000000140000000-0x0000000140269000-memory.dmp

Download

memory/888-106-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/888-416-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/888-97-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/888-102-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/1272-89-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/1272-92-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/1272-83-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/1272-323-0x0000000140000000-0x000000014026A000-memory.dmp

Download

memory/1628-158-0x0000000140000000-0x00000001402C1000-memory.dmp

Download

memory/1628-133-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1628-127-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/1844-109-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/1844-430-0x0000000140000000-0x0000000140254000-memory.dmp

Download

memory/2068-165-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/2068-462-0x0000000140000000-0x0000000140285000-memory.dmp

Download

memory/2296-63-0x0000000000400000-0x000000000130C000-memory.dmp

Download

memory/2296-7-0x0000000000400000-0x000000000130C000-memory.dmp

Download

memory/2296-0-0x0000000003070000-0x00000000030D7000-memory.dmp

Download

memory/2296-334-0x0000000000400000-0x000000000130C000-memory.dmp

Download

memory/2296-5-0x0000000003070000-0x00000000030D7000-memory.dmp

Download

memory/2308-156-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2308-263-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2376-268-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/2376-68-0x0000000140000000-0x0000000140278000-memory.dmp

Download

memory/2704-30-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2704-36-0x0000000000710000-0x0000000000770000-memory.dmp

Download

memory/2704-49-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3156-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3252-140-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3720-65-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3720-57-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3720-51-0x00000000016D0000-0x0000000001730000-memory.dmp

Download

memory/3720-64-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4092-167-0x0000000140000000-0x0000000140255000-memory.dmp

Download

memory/4256-21-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4256-24-0x0000000140000000-0x0000000140268000-memory.dmp

Download

memory/4256-15-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4260-161-0x0000000140000000-0x00000001402A1000-memory.dmp

Download

memory/4284-461-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4284-163-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4600-756-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-787-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-778-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-755-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-779-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-757-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-760-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-759-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-758-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-761-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-763-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-764-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-766-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-768-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-769-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-770-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-767-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-765-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-762-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-771-0x000001A615D20000-0x000001A615F9E000-memory.dmp

Download

memory/4600-772-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-773-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-775-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-776-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-777-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-774-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-783-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-785-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-784-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-780-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-786-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-792-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-791-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-790-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-789-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-788-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-782-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4600-781-0x000001A615D10000-0x000001A615D20000-memory.dmp

Download

memory/4644-61-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4644-27-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4716-116-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4716-122-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4716-157-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4776-78-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4776-72-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4776-81-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4776-298-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4792-463-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4792-166-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/4792-320-0x000000000C3B0000-0x000000000C3B8000-memory.dmp

Download

memory/4792-168-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/4792-184-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/4792-200-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/4908-162-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5044-460-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5044-46-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5044-40-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5044-205-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5044-60-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5044-458-0x0000000000890000-0x00000000008F0000-memory.dmp

Download