51f68dad69aad9a43092c3280e8a3ebc382d5d14d0fe3cf3d79e10b3f1fa5744

Analysis

max time kernel
151s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
Size 14.9MB
Sample260804-262sysab49
SHA256 51f68dad69aad9a43092c3280e8a3ebc382d5d14d0fe3cf3d79e10b3f1fa5744
MD5 304b2f0cf5720e8c2832ba36f964ee11
SHA1 8f459d39013e57a63c782c2c51e6b81966c7c3af
SHA512 6a43c554e51d07352e66fdda183ddd1af615469a12a502e4d82a0446c90acd2d652d73f18952fd0fdfbeec06b9f508b6375fab162834df0cbdf46f9af75b4410
SSDEEP 98304:77aQkrJ0hpjhsnzsHcXoDqPtHCrk4cnN1zOFEjIOlxPqH2ExNS3jxakZ3iMc4IID:7RUysEbkPO2jj+tOjxakgfgeXS5Tp3n
TLSH
T130F66C04FAD78075CE7702318A29A6FE01EE5E6D5B202BCF512CFA6934315C17876B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
472	elevation_service.exe
3112	elevation_service.exe
2556	maintenanceservice.exe
4848	OSE.EXE
4276	PerceptionSimulationService.exe
1136	perfhost.exe
4736	ReFsDedupSvc.exe
580	SensorDataService.exe
5216	ssh-agent.exe
1988	AgentService.exe
2156	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
5844	verclsid.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c938bc523e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4512	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\128.png	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_2123047320\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\dasherSettingSchema.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping484_952493309\_locales\zh_HK\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5320	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094a2c6246724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f9b192e86624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006420f9ea6624dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000686823e76624dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e75a7e76624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000878d90246724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c1002e76624dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{8C4F3592-22B1-45E4-AD25-FAC9EA83AF44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
4848	OSE.EXE
4848	OSE.EXE
4848	OSE.EXE
4848	OSE.EXE
4848	OSE.EXE
4848	OSE.EXE
4848	OSE.EXE
5624	msedge.exe
5624	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
Token: SeAssignPrimaryTokenPrivilege	1988	AgentService.exe
Token: SeBackupPrivilege	4736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4736	ReFsDedupSvc.exe
Token: 33	2156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2156	SearchIndexer.exe
Token: SeDebugPrivilege	472	elevation_service.exe
Token: SeDebugPrivilege	4848	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
484	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3380	2156	SearchIndexer.exe	100
PID 2156 wrote to memory of 2960	2156	SearchIndexer.exe	101
PID 4512 wrote to memory of 484	4512	2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe	102
PID 484 wrote to memory of 2616	484	msedge.exe	103
PID 484 wrote to memory of 5320	484	msedge.exe	104
PID 484 wrote to memory of 1588	484	msedge.exe	105
PID 484 wrote to memory of 4284	484	msedge.exe	106
PID 484 wrote to memory of 1588	484	msedge.exe	105
PID 484 wrote to memory of 1588	484	msedge.exe	105
PID 484 wrote to memory of 4284	484	msedge.exe	106
PID 484 wrote to memory of 1336	484	msedge.exe	107
PID 484 wrote to memory of 2472	484	msedge.exe	108
PID 484 wrote to memory of 1336	484	msedge.exe	107
PID 484 wrote to memory of 1336	484	msedge.exe	107
PID 484 wrote to memory of 2472	484	msedge.exe	108
PID 484 wrote to memory of 2472	484	msedge.exe	108
PID 484 wrote to memory of 3020	484	msedge.exe	109
PID 484 wrote to memory of 728	484	msedge.exe	110
PID 484 wrote to memory of 3020	484	msedge.exe	109
PID 484 wrote to memory of 3020	484	msedge.exe	109
PID 484 wrote to memory of 728	484	msedge.exe	110
PID 484 wrote to memory of 728	484	msedge.exe	110
PID 484 wrote to memory of 2928	484	msedge.exe	112
PID 484 wrote to memory of 2928	484	msedge.exe	112
PID 484 wrote to memory of 1660	484	msedge.exe	113
PID 484 wrote to memory of 2876	484	msedge.exe	114
PID 484 wrote to memory of 1660	484	msedge.exe	113
PID 484 wrote to memory of 2876	484	msedge.exe	114
PID 484 wrote to memory of 2220	484	msedge.exe	116
PID 484 wrote to memory of 4496	484	msedge.exe	119
PID 484 wrote to memory of 4496	484	msedge.exe	119
PID 484 wrote to memory of 4296	484	msedge.exe	120
PID 484 wrote to memory of 4296	484	msedge.exe	120
PID 2156 wrote to memory of 4252	2156	SearchIndexer.exe	121
PID 484 wrote to memory of 3004	484	msedge.exe	122
PID 484 wrote to memory of 3004	484	msedge.exe	122
PID 484 wrote to memory of 1568	484	msedge.exe	124
PID 484 wrote to memory of 1568	484	msedge.exe	124
PID 2156 wrote to memory of 2212	2156	SearchIndexer.exe	125
PID 484 wrote to memory of 5796	484	msedge.exe	129
PID 484 wrote to memory of 5796	484	msedge.exe	129
PID 484 wrote to memory of 5796	484	msedge.exe	129
PID 484 wrote to memory of 3532	484	msedge.exe	130
PID 484 wrote to memory of 2152	484	msedge.exe	131
PID 484 wrote to memory of 440	484	msedge.exe	132
PID 484 wrote to memory of 1684	484	msedge.exe	133
PID 484 wrote to memory of 1684	484	msedge.exe	133
PID 484 wrote to memory of 5704	484	msedge.exe	138
PID 484 wrote to memory of 5704	484	msedge.exe	138
PID 484 wrote to memory of 6096	484	msedge.exe	139
PID 484 wrote to memory of 6096	484	msedge.exe	139
PID 484 wrote to memory of 5624	484	msedge.exe	140
PID 484 wrote to memory of 4632	484	msedge.exe	141
PID 484 wrote to memory of 4632	484	msedge.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_304b2f0cf5720e8c2832ba36f964ee11_bkransomware_darkgate_elex_hijackloader_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gomlab.com/gomplayer-media-player/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffd2983c188,0x7ffd2983c194,0x7ffd2983c1a0
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14513327345361780334,8691535103223405994,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,5929725379384006129,8134345742567297000,262144 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,17518600657345253363,3547746175797477277,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,2061382928525486741,12663637331069488683,2097152 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,14293646690338118716,4528482885681414909,2097152 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,15632599093625741689,12447967528274638745,2097152 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,13567894648826357725,10234206060250167379,2097152 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
    3⤵
    PID:728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,3649975501780575931,10417750462017933184,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,8061393327553055894,15399040645490698185,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14175229755300112589,9842915140184211830,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
    3⤵
    PID:2876
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16614315269292749875,17847663419831521552,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16614315269292749875,17847663419831521552,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,16251422412178748189,1679407821566400477,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,16720494915962417589,8844108111114458218,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
    3⤵
    PID:4296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,1630487860381626047,8972600585826886613,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
    3⤵
    PID:3004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,14977294819490153091,5828410832967576929,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6480,i,6508021930668847547,16751905722414408823,2097152 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
    3⤵
    PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,5539186079717429310,10918939309186191977,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
    3⤵
    PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,17636788465769673769,13858356379855351620,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
    3⤵
    PID:2152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,13821183628285092443,7113139176151548442,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
    3⤵
    PID:440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,17943151844457997007,2417603783686184144,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,16772116881117856333,6411126203474455707,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    PID:5704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,18135649710022936561,14139639804381412866,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,1163917731520240877,7669450962422891123,262144 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,4492669420620834462,13767141629805395412,524288 --field-trial-handle=2388,i,9750802573108487653,8614491923497925447,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
    3⤵
    PID:4632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2556

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1136

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1892 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2872 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4168

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8a155b32b8e0aed180800f07ff24c6ab2b559b7e1e19cb355b3a1f023f78bea4
MD5 e8b774391e6491a1b26066f572d67905
SHA1 c51eaf70873482087c74ba35b58bc26ae5380156
SHA512 5250ee693abd735126a1f799b37dda26c90722e457f7c368118e12501be7921f8c21609f704fc561dcfdc038f7931479b1b13200867adcac36ddeff535dba9ec
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEXvYMLprznyDSga9:z3q6HjBxXvYCp3nyG
TLSH
T1E4D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 34d74b18883fd5f6b358a8ddbbbf31c7aeb544b7ea6717a17e3125528f2209f6
MD5 ee5ace1bb9cfa9b58909bc1675377e08
SHA1 d13106bd3b02d286b1f2396b2abbadd734e9e9d4
SHA512 b164d6c86d122382033a81115c21fa129b9619517c5ff5a88c47a46a27ec5e1161197675cd79c00b4289a39d64fc97081f84d059cfa1c8757d1231727c9b99c3
SSDEEP 24576:RXYfDtczAlX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:0tcWXvYMLprznyDSga9
TLSH
T1CF850128B3E408F9ED27813DCCA28405EA7378954760E79B03E0996A5F377D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 31efcea63bea7cb6c1b1ffccff4d9ec929c3c8bbc43a8ecac55f6ed1d40653af
MD5 59b7451125e04fa5f2f1e677aa1346da
SHA1 d153d746ffafb1056da908632c5b146d8d4f1ea6
SHA512 470d1825137c13b3ef91babb2dabb447fb0dd2f7525216668ec71357df37110d5cda8504296febeae354b3b8c7926df44f981a63799d75bf65a1330744de06bf
SSDEEP 24576:80Le5ji0hmxirM8X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:8Pji0Ac7XvYMLprznyDSga9
TLSH
T144959E15F6788335D073C0B9C5D2A68EED72308657308ACB4286D77C7E6BAE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d11f7a63435f142d65b723108f1f443229080f36ee6ee6d71e80d7953b019705
MD5 32fc3cb8b4fc52aa69adaae6b2b38d02
SHA1 8b389dcf5ec713461f361e0ac86844d059a11be7
SHA512 c61d242999ae8c9a4a2ce9aa1482a4f72d4157ff251ea1283efaa11db0559136f11b009ec843d0a5c9b83fb884ee47ac6629c484bf0e5ac6f9da8570366c6e9a
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:f/ezSC6vUzPvxHjy/XvYMLprznyDSga9
TLSH
T14B756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4abb71393f87ae5089f9289f9adb4cb74db1d3e24bbe5b2d9ad5a65dbe1f9da0
MD5 d2f75a6d915cabecd028b55c2e78d07d
SHA1 931c7626a7308f752ac19a74b3dd2c58f77ef9c0
SHA512 0296d511291bde8c95614a09e7309004a95f7ea7890e5533ec61d11e2c76daf21f8cc87c9232735c9f39f5611199bca952e48e4e29ebd06176402e33032ff426
SSDEEP 24576:YVbqPb88hv/l+6hX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:YVO88hXl+gXvYMLprznyDSga9
TLSH
T153559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 4cbb4c7b4729d1724e4cdd2f8d331489124565c55880ff4f4c5eee874e15cfe8
MD5 9375d63e09eaa170a43de10180e1f187
SHA1 6af538793aac6a5227c51f3480bbe4b33442ae90
SHA512 07766fab94b1e4a75188cb54e52ea8b8797324f188ecf9a62fc935a5bdbdae496cf82eef98326e3ad1f40c2f19d7c8fd1bd499eec7184e3444f803b794cdcf6f
SSDEEP 24576:GRIX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:fXvYMLprznyDSga9
TLSH
T1BF652314A63C68F7FF2B54364CF5480DA86F2EC44409AE2743D2BADE94FED78E446125
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d1061d331e315c8be3153fa8f1bb9b9015f4d5cd792fd66b975bcfdc83f264d9
MD5 01774b474c4ca07a95016776b063ce20
SHA1 1f951f96b3e0bcdbc62b8477e07e7e67c5b5f507
SHA512 9535e3d1b059f47825d3ec707bc7a073bf96e33f42b1949cf1245642da63830f18c8cba2dca8660e89d22672d801723a75e963614e709ec14e7fc2575b90b61d
SSDEEP 24576:fJIU5X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:fJIU5XvYMLprznyDSga9
TLSH
T1BC85CF3BEE38FCE2C67E4C795A918600E77278704B12A3CBD165820EDE275E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 98128e3a4ebf9db90575ed53ff16fba5674d386db1cf44538b899aa465fa331b
MD5 2e24e3dc387b1a717919a301a3984625
SHA1 2b5e1208893fa4ce1f91afd02a2ed43979c90990
SHA512 68d1af0fa3e0238cfdfed663ff114566699fdfbbfabe707e30e6880c529719dec83028e2704a465916ae37268c092593be19cbf92b6358b16f8e893d20769112
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:HQvGAdlCEL8c/yRNw5C2XvYCp3nyG
TLSH
T1EF267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 6f6e3faae31687eae5aa508a9810b7c184fe88f9db2dd01b7f47454da5d902bd
MD5 6e347840480a181cc787c079ac3e868a
SHA1 684bdc4a36fe01b6c926ebf301750a9ab776495b
SHA512 8ed530adc9ed8369cd73e414de5c12292cd6d890f4b3303dd29c87e9f00b89927edc2b90a53d9cfc8fd0128975d9d81445ffe1ea2ee964dfe7ffd2868a02809e
SSDEEP 24576:6dewsAjrX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:KljrXvYMLprznyDSga9
TLSH
T1C585E030FE74E436C77B0CB21B76C70A186D7A604B511AC3E3E88E9E59742D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 059760ab3d2ba0a976752bca72e99dc376b0bf0e7b6db2e5f8eefb8554c94b2e
MD5 05109a1833fc43ebd67d18d82d5677a5
SHA1 af23930d39a783bbe6c8326e37ec232980ee05dd
SHA512 ae70b4a2d907d1c8dc47fa87625755d5cf01dd101c3aea616fbadef3caeeecde903e03ab5269bea7a6cede30356c6f53e8639212cd793f0f8beaad369297794b
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHTTp3n:/UEtQevvqc2W1cpV2EI32fh
TLSH
T1EC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1fbeb6e5dead9011ae85a6c31af576e23f9271dbf67a8cbfbd9c1a6c934c50a0
MD5 4f81515779ff35d19a5c881976e69fd2
SHA1 df7c5c7066ae8b7d43a6807e671046dab6b32372
SHA512 01ff01c9eb3935a9c953664c7d5f409297695046cdb4f07cbaecb83f2ccda8a773bea52933d31290ccce949dceeba3b179c057911ee1515ad3f4790111f39b5f
SSDEEP 49152:cCbRquA/m2yL5zLfFiV+XenmE3/zLXvYMLprznyDSga9:Voq2Vjnm6XvYCp3nyG
TLSH
T116D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 abf693738e77dcff76300b207ab5804a46bd7d8f8871a421d3892dc328deed2a
MD5 95ac541d0135a566fdb07f4add3b57ef
SHA1 3849212ff737a0ac1fbb6020e90eafcad2f3dbc6
SHA512 d67f1eb8d1e830c53a1e64ddf1bf638ae2bffc9e66917b6df7f072e80c06c2c07cf4aff9d7684e1bc8a2098847984fd8c6938c3d8ac251aa2293513e705b7e5a
SSDEEP 24576:+AhGLJIFoiwtA5l7S53aX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:+AMyFoiq5qXvYMLprznyDSga9
TLSH
T166359D80E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2260D11F0E37E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 8e9ab9acb0329acf2aaa256bc0d8833b446bfea4eeac0c8ea633059a610390a3
MD5 db3354e348095dcafe400a506b0bb5ec
SHA1 8987120e39469bcff8a6f09af8aa0ab6e7ca6d44
SHA512 cdd14b2f40e5f27a5fd7b5faea80a6401f742df5767d1448ada7fd46407ca9f931b507ae69979345bd00fc73adf1e996f1bbd59542473167a3233ad16564a5f2
SSDEEP 24576:zwuoOWfX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:zwDOeXvYMLprznyDSga9
TLSH
T13085F10576A81CF9EA6781398997C536F7F3B8412A25DB1F03A0C65B6F37321AD1E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 de5935fdaff7418d0c26ad704bf734b80c5b0ed7c042ababdaec5cb52edb5146
MD5 531b7dba6da45eb60f83d7949e70011b
SHA1 d299295e3d328c89f798f847c78089d0921ac650
SHA512 1895aa0ad6ee7cda4c21faf38a4ef84ccaa7b5d3e50843489f9d24c17094076c2415503a8bab3041c51fb5ed5e5518ca0c18005c79d8d621accd36c60f2e2bc6
SSDEEP 24576:2Zu0X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:YXvYMLprznyDSga9
TLSH
T17675121932B830FAE667513DCCF14509E7767492173683CF026146AA6F7BEE56C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 346da47d013d88bcfd5c0ebcc432d9a01250eeb6d0a1750286573c778c2a64db
MD5 86938885204573d61d21d3e9d9f666c0
SHA1 595b42771c3f1463bea88196f096b5afee1c10dd
SHA512 cae75e9ec18807eeb1424abcae8878ab7329e822452e5684fd307f5e4f85ab2c188e338344c35c50cd42e75c9a19c8a41045c0f3e0a756b4bd994558781378f9
SSDEEP 98304:0QRQyi36YOcPQLvw2gAf+PN39XvYCp3nyG4:bQyiKayX+PNNTp3n
TLSH
T135667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 45f8c04ec436492c6bbd008c0e065c3fa1d4c269d37047af30d61d98b502fd75
MD5 66ac1c1922f273abec34905f85f2ee02
SHA1 2d90c4952310c010595e8ad7b4abba91aaeb6f64
SHA512 9351f4494a45a2bec8767758ea411799385b9a772a4a96796feb04243a9acc35ba4261cd009dc093af9dd7224a068305c3d3c7193073fa689717dda0884e370c
SSDEEP 98304:gQRQyi36YOcPQLvw2gAf+PN39XvYCp3nyG:3QyiKayX+PNNTp3n
TLSH
T1A1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f140f3170a219970fa5dcb066e0267e401a430123bf59380d32b005c57c2723e
MD5 a11aae7d511007b03262a512c1639192
SHA1 7672495e354f0e52063d896409b4d7fd0bbf80cd
SHA512 a5ee15ee1cbbacd2c45edb8a1b6b8efca5b89734868e10186f8689e33b30946cc6e1fe34dde773d33e1678084c9278e76eb0ced6cb3e76602ca0993794f41628
SSDEEP 49152:068Qg55nhheWu7PNU3/7XvYMLprznyDSga9:ethWRc/7XvYCp3nyG
TLSH
T169B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e1bee15b55a51374caafda24380d00ad4c36b1ca35c9e215c57132c944eca124
MD5 9891d399986f88d03173bdb0848a4259
SHA1 be59920f40bc622f89cf5ac03a189a91ab4a5f28
SHA512 039ee460bcf940da06469465993aab4ee75cae1a244079427d567109021a2a5644a6748ec9c4837a11a7945febbd4b0d95eab570528fce9806ad273b9a7e5e6f
SSDEEP 98304:Zy5112gYy5azzVvL69nLKnhZIXvYCp3nyG:0LIHmWhiTp3n
TLSH
T173167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4eff1e7f2cd517c89767f787ef1ffd3025858d8171d13ecbd4af26e70db4c1b2
MD5 263c1afc52a9582da0d81442a55fc03e
SHA1 7f8bb344221c7385e2d1d34fe3ebf33912512bc2
SHA512 cb4cb198d1c5dfec148ceac94743c85594e0722627c32ac2ff3259aa405d1033dd506bafda83bc496846eab8fe37ecd9d8f7b24d0c6a6b8c7ab7d2caa95fe848
SSDEEP 49152:eB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1XvYMLprznyDSga9:Mu6JmVxd2d1XvYCp3nyG
TLSH
T14ED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6bdca5397474a8edcc2479f2b107675985b6c842da34bf6fc3d4408e64f009ef
MD5 d71fdffef1b328d10ce1f9ebdc7ea13f
SHA1 02e7343d7dc7197a5836dce3d3fcedf5fdc89e0b
SHA512 feae4b29933eecabc834dc761b02d6ed43467c6b8f6eec8cec55d9bb599cac12836dad1f51b43afce71b5120ab559002b0cb4f1c63f27711df8c72bfd29cb8db
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xZXvYMLprznyDSga9:jmifPbR6XvYCp3nyG
TLSH
T17EB5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fb6a5cf160fa37b086445d6d7fadb9490a477f38b57641be7c8bf14ac4f9dfbd
MD5 08629db2243873f302eab7dab120a7bd
SHA1 2946e801eb8b98df4735ada42cf27e01a5e830ab
SHA512 07026c8ebb56d09c42de6c11973ce1aabea649f6fc5ef63ad64efe10fa662b8f405fa86555407b7e9f69a32b41dada268a0738327f4407f31bd9a8812991f6c4
SSDEEP 49152:qSuZQIY0Be2KRRVtOnks6NMHq0XvYMLprznyDSga9:05dKTi610XvYCp3nyG
TLSH
T148C5BF03F2E941E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 25d26c1c928b8e4b41c8b492df6812a87b588847a8256e358205a05cb8e8bece
MD5 0e80009ba3d2efd47b2e149f1c4988ff
SHA1 db9478ce5ad443e7f7b22b83d516ec47b31ea908
SHA512 c40f8c03ee9d277be7f4f464bd03de459cd14f7645f7cdb672d45b0cb6d7782b7579c8232a24d1cad39d01926db03e5f0872f856644a8896300505424cff7893
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5wlXvYMLprznyDSga9:HX2iyph+XvYCp3nyG
TLSH
T1AB95BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 93afa565f97f6a4095aa1da6fe42401460d74305f6d5618d2a31ff1b76387163
MD5 0bcfd040885a9f0b22a19fa5c8bdc21f
SHA1 1f17a5d7633bfc07bc3261d0833df6212b50e6cb
SHA512 c52ccd328aedc36a8960155dbd2f5003eda7b4449cb9cccdaa523c70ad70b7ef3585e3be87c17d7bf78fcaeac67d3bb4084de9ce31f6ba29deb4c117d0f4822a
SSDEEP 12288:RgLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:RgX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T160652314B43D69FBFF1650368CF0040DE85F3ACA840A9A2B53D3A59EA6FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4660bbae664d6d7175ee4a3127cbc72a6556b42e129f07acdc9e9f3d2331c7c5
MD5 baa5526c4713f725879773fbb4ddb8f5
SHA1 92393e717e15a3682a1a6df55c5b82311790f916
SHA512 f5f3d5e1f974a7e88a0cd73df1d23c61ec774f325c6916e52e265069fa90769ad7dff968a1c3266942c4e47fe60744229c45928df661e7384c1139a7c19285d4
SSDEEP 12288:wHLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:wHX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1A7652314B43D59FBFF1650368CF0440DE86F3ACA440A9A2B53D3959EA6FFE797846024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c36faefc87359d52a6ad3c7481f0084348d69c81aafe8324e511e1cb88f2dc97
MD5 a347ad434d1682031c6830d5a5dc5843
SHA1 c8795285fe8fd045e5bacd4835d933f500e7de6e
SHA512 93e3de39a95fa9719a440604c6750fa62aa7c725f4f6e1aa4dea73bdc48bb0d79a85858bb9f916984bf4ec7aa0b6457e87e52621fcb931b3e851112760536322
SSDEEP 12288:8xLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:8xX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1A4652314B43D69FBFF1650368CF1040DE8AF3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 72d47d704d86e6dd71b16218d09909d6d7662d7f63b5fa47009eb0432da48bcd
MD5 97343c4dbb862613f953fea7c7b35bc7
SHA1 d4e6814204fad41c68e0e96b63490912317a6515
SHA512 d8245273f43db63e47b2516acad19e1ea807f840a2d7afa5c3628606290559bba4de604dda40dd05981822029623d203d1a1f478367d7d1285e9ac6a724b290c
SSDEEP 12288:6V6LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:HX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T16C652304763D15F7FF26913ACCF14409E4BE79C586269BAF4382099E5EFEBA87805224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 30dcf09611dac17212e2d8038cf4c74220a9888a2a6b3e0f7dbd780495f94ccf
MD5 47096637e3dabb302c402427c294fe01
SHA1 f40d901082dc0f1a4e645dfb61f96159a04a74fc
SHA512 6c6e68daebb73943126a54996cb1001c850c8528dff97fc6c78c11cd3d6eedea56329994e6bd55a56c48329f05abc463d1fcd0d519792ef893dac84aadd6fad2
SSDEEP 12288:vCLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:vCX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C9652314B43D69FBFF1A50368CF1040DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 36efd07131d7c0c4e0235e45196e5d0453855d4ee6a1dd2f43d37ab769fd534b
MD5 b45ae2393b30b1735f7b5c28a7fdfd39
SHA1 0899ef901878794759d55adb37e93e13fe375db7
SHA512 815d756d8621114b4c867392417cd09ea1b4fb6ea0950b8eaab414e6c9998f74846066458a8fac73a2e855d90f2a06e9ac617a74cefdd2e9a9623d51c76b2476
SSDEEP 12288:WDLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:WDX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T15F652314B43D59FBFF1A50368CF0440DE86F3ACA440A9A2B53D3959EA6FFE797846024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e9f4a1c95cfc4bf155be16682ed5b61b35f5b905153520b539e05fd8c6687d84
MD5 6fd2f282c247ddb411634e479da89d3a
SHA1 89bd58236cc2f3ea11749a7fd9255171e9b96bc7
SHA512 5fe7d35f16340fb4139062e4e197ce56be25800d12ededc2964773d0f0a382a15392904106aa2612d815d7c8225b91fd073ea67e89e0852fe8bfa7318bfdc7e1
SSDEEP 12288:AvLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:AvX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T178652314B53D59FBFF1650368CF0440CE85F3ACA840A9A2B53D3959EA6FFE397446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 61ea6ef2dc75a054cb676809b9fb53dc526135c21045496764e16e218d170cbe
MD5 acd4c2946058736f0878a757c39368b6
SHA1 8c3716f919d4cb0d9bb0f50be6bc2b2e5e5c709b
SHA512 57113ab9da3cf2a22a79ff457c6ca733150055e0bf0a8fb0afd7b9b3699f1777ab69cf5db5e9f1d400cd894e2b8f84e8c4972c05c04b623d2d683202e3907945
SSDEEP 24576:mZMSzFVSOnX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:mZMSzfzXvYMLprznyDSga9
TLSH
T181850154B3601CF9ED67813ECC65880AD6B27C5A0B60CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 79dd494114146f81acf99c8bcd24142bf3108028f44e685f0b167d7189ebfcab
MD5 7118939e1b93a381e66be966da7a2309
SHA1 cee56fde868014d6be7ca6cc83b1abf7228767d9
SHA512 d3a58a33350d4d72cce5e5d035f02a10d8edd0e317817f0a1f25b56e06daf43895169182dc4f6f5cc512386a593ba666b7c9902a57e2f9052bd94d12cf2f2f89
SSDEEP 12288:kkLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:kkX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T145652314B43D69FBFF1A50368CF0440DE86E3ACA440AAA6B53D3959EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c41fb251179fbd2edc85202b12b5ad8dfefc7704fdfaf3bcb7150413ff21eb60
MD5 ecc2835d9659c68595e58d96a630cdcd
SHA1 dab4f0fe09077cbfeed2f82370bdae58fd770069
SHA512 aa25f75905772b264049ed1fa5094d93a0513a6ad4f55342bb4de88137b6d101a0704590bf4959b9afe8b6a9bd1fa00d1582dac7a24b99eee9cbbf3b705a1fdd
SSDEEP 12288:B4LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:B4X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1D9652314B43D69FBFF1650368CF0440DE86F3ACA840AAA6753D3959EA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 4365705215fae203b7f58fd884d2b617a838b454affba13dd05fc94afe7dcc87
MD5 732d7ed1db5481bbd2ff250669951306
SHA1 22ea24cbaf92939c19bf432d31a27e0efe4e5b49
SHA512 4616a22b31e53acfa96bb7922f643e7eef22186f27ba4f14f7a4e18670d689624651ac8e6fc5d81acc9ee9639b93b24a4b006e52175b3f43542c2d38f8d74ed4
SSDEEP 24576:qzybX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:q+XvYMLprznyDSga9
TLSH
T14A750207737530F9E6379139CCA10905F776787607249BAF13A047BB2E7B6A4AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 199eb3572cf485bf19b3ce8690eef3fbcbc609cdd8c09bf18e1a05229cc3f4ff
MD5 46318f2f4558f000898c91baa6fbce6a
SHA1 046fc166a249af5f9ea75027f733c87ca8f4426a
SHA512 de1b9698bb8494e6b522a0a6e61c16e6a024b7e2aa80d837707b540c3a0d6b061c7f54ac808e626f0611d66f11cd31740ba26c5538b6d5e8d455c24fc4685879
SSDEEP 12288:0kLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:0kX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T15F652314B43D69FBFF1A50368CF0440DE86F3ACA440AAA6753D3959EA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 4e059a55139f27567eebc3ce3fbb23c1a5ecc0b3f603807c6cc03975db78c12a
MD5 7fdd398f702f130b284877f853da9a24
SHA1 66d380fc4e4f7e29797f575888807906e3271644
SHA512 7dce36a51abb1e93a3c561c124ff320644ac92baabb73e5e398189d9de82192a92115a18d144a3cd384cc412db178b42a4d1b40abbf1648fa75394526ab2fef9
SSDEEP 12288:+kLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:+kX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T17B652314B43D69FBFF1650368CF0440DE86E3ACA440AAA6B53D3959EA6FFE3D7446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 36a89f50d3940d47aa494e0f6e15ff97d3fb217774a176c196d42260de143fba
MD5 7a7a129f5f83063fdf8197a6a49891b4
SHA1 97828f703f14790b5358bd08e99145d888b3758f
SHA512 e666bf76746d566db394797c789777b442fc215b2dcd95bcd1adddb01215abc7342440cc8deb97d413bae1e19831c9b075bf839f02281cce49d03e6772cd4623
SSDEEP 24576:xzybX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:x+XvYMLprznyDSga9
TLSH
T1E7750207737530F9E6379139CCA10905F776787607249BAF13A047BB2E7B6A0AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 3c6b964448162c0b357e020e00e86cd18fa9d831269366f23f68f016eeb32cb5
MD5 a4fc4478b901521614d1ce52acb16188
SHA1 b58b048a88f3053de86e9428247370395cca9035
SHA512 fca86155f5b725f7be078918caff884c5fe9c736acb92eb981a78fbb3e3451f1950e6dddfff5ff927040549fe41360ca7b549bfd32a24cdba328c0530372f1dd
SSDEEP 24576:JTHaLl3z0zDBX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:JT6LljGXvYMLprznyDSga9
TLSH
T1CB850164B3601CF9ED27813ECC65890AD6B27C5A0760CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 ef7f4460ef776e06ace2ed7bfc58730e8f7df9593a9ba8b37826f52541b8ece6
MD5 eb8c9a9580d7e55d6cbd0bbd35be7a8f
SHA1 61c8c84ec4466fb91d0baf3831de9c101a253cff
SHA512 70f44aedc92f7854b9dca601e98606bba3850039583bba49cfe0be87144c7e56b516bb330614defdc4f80f8ad57af8be1eec0ff7e65c4e802d90fd568f6f5484
SSDEEP 24576:S37d9CHKy7GZdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:07d9CHKyazXvYMLprznyDSga9
TLSH
T19C95CF90F3E814E9F1779A358C764501DAB67C9A1B21DE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 04048568ed5ae2d1fbcca7157a00d6793c3bd739884236717938e1ba9485e441
MD5 3f6f55b3a811f7ab68c949cc876195e5
SHA1 c7eea1166508dfd2f77d6bc8cdddfe3599fbaf9c
SHA512 27e0b157fd0b09f6d882156a939461c2c629cfdbd4bc610f6e8a409a480b6a2ca02aa22fc342dd18837cccc27c7f38c1a401a261be90c5302027757a8392a135
SSDEEP 12288:YRLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:YRX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T112652314B43D69FBFF1A50368CF0440DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e64a1f386b9ff25300b7b15e87c9e5f9f619c1ccb04bdd7ff06e5bebaee18047
MD5 d0e29c8766690583c3202da3961bf8c6
SHA1 777ece95bd117df300b878d0c8ca3115841b3200
SHA512 9350b82e3200f59df1d99e231d464463a408a729db13a455c9c9e5181b3eb0573b8ece826d1964303e71667e0226fbd40af71473bed26d45714a22e545dcf0a6
SSDEEP 12288:n7LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:n7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C0652314B53D69FBFF1A50764CF0440DE85E3ACA840A9A2B53D3949FA6FFE397846024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 b488a0b7c4c547eb1e9ea465f6d40139c81a1aaf993ee0d85e691a9cabd8e2db
MD5 24c4dccd1c1a1058e33c2bf1c98fbccc
SHA1 38a38e92dcabd605a240297659745bda593b4b58
SHA512 4f90d92d13cc841c59c4cef6f5a0ab8919aac1b6f096ffc44fd76576b554f4d1301d17b7e044f5c455c6651b1bcde7e4eddceaf4d7da1d6094cf494cf2ddd16c
SSDEEP 12288:QuLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:QuX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1BA652314B43D69FBFF1A50368CF0440DE86E3ACA440A9A2B53D3959EA9FFD7D7446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 0f36aecadce4f8b90e7bdb945065fb78f56348cabd2cb3dab5628979a195bd0e
MD5 ad6787a1d324cf0cc67fab099a9e1de5
SHA1 32f07c95ed088dba3bc8d252a1dc3cf78fe00f16
SHA512 353e4e28e3de980b26b1ac4ad3297a2ed9055a9de7c718cd1706dacad834dad6272e0b26d0e85ae6b0b9027b5d5438c7da11caf56c079b500ad074216cd7be42
SSDEEP 12288:XkLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:XkX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1AC652314B43D69FBFF1650368CF0440DE86F3ACA440AAA6B53D3959EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 efbfbea00e498b695f0ebefca32a58e0e648f341b687d3bb87d5915b320e5ace
MD5 69cbe1f5fe15fc1dd8a1bc9254744585
SHA1 ef438510a01be755c071783fc3964a3d96a350cb
SHA512 ac988973b415855a188e7de024c4cdbf8c9d53b7dd39f3ba118ca59964313233378b35f7f7a35fae7cab5c45154ccc0d8fb52cbb383eda5b1013cf2625613773
SSDEEP 12288:+RLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:+RX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T15F652314B43D69FBFF1650368CF0040DE8AF3ACA440A9A2B53D3A59EA5FFE797446124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 cfce98d3d016a1f7b5f1530b6d923b8edcdd1344d6489dd8361d00e4848e503a
MD5 f7a608979752475961bfe54db20fc84d
SHA1 f392e1152d07444ddff0ce0ae0a06d46796d92dd
SHA512 5836270cf7bbdc753a5701a5c287bdc285657a2e42d45ba84942b532aaad80e72ffecf102b2dd67b9b32f69709bbfce913feda66368974d2bf75aece57a24c46
SSDEEP 12288:CMLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:CMX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T190652314B43D59FBFF1650768CF0440DE89E3ACA440A9A2B53D3959EA6FFE3D7446028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 77084ae46c10972b806a70f7201542f20d806da9e6792fc24fa4a648f4b2f3b7
MD5 32db44573bf3c4803409458c2d3183c4
SHA1 4c7b43bfc1d71ccdc299bcb4bada95d85d30e46f
SHA512 3d11900b4d61407f8e42f82cf38d2257d2645a18ea83f1a6a0cfd051ab8d03beb8d9d38107d47574cc10c2b889267ac2940b5aebe3c52a66c6e08daa5da536bf
SSDEEP 12288:/CLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:/CX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T100652314B43D69FBFF1A50368CF1040DE8AF3ACA440A9A2B53D3959EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 e9f9951b047caac3f8216bd71ce7aefaea901ffd21c43f7b57909ac9589c6e9b
MD5 56b4cbc81f00ed18771a12ea20521443
SHA1 63b27e8c0c1e4c15c84c6ef1b86877a195743aeb
SHA512 64ecec6ff20d2c27437d1c61af191be112bc0c9959bf4806d7c782f86bf1dcf6d549fccfa32e2e257e44bad2a987288ffe9ddabd0c29be105b1bdc636cb30701
SSDEEP 12288:opLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:opX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1FC652314B43D59FBFF1650768CF0440DE86E3ACA840A9A2B53D3959EA6FFE3D7446028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 5b7ada3fab313a51800dcf19646155a5e0167beee9f9670c70432257645de328
MD5 830ddb91d33de15f9d12f9720661a52f
SHA1 45610edb9728dbb562103b46cbce897fd8357770
SHA512 5e6226d6e92f13c0680c70689321f175cbebb74392f4ce3af362a687169b641aa389ecd2fe6488e08409a3e6d84bb9444c49d517fafd2c16ebff96871c50331f
SSDEEP 24576:Xfwvok9RX6wkyAIoX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:RMnYIoXvYMLprznyDSga9
TLSH
T18595CF29EBDC44E5E177913C89B3460AF6B178591B31C6CF029A53AE0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7171a1f33fff66176a0a5eddc109c90de4563b674520d2674524ab729d299b9
MD5 4f3753e6c14a66698f3d94df51c76e7f
SHA1 2b53a692b03dca9d26cb5138f7bbfaf84bc2a5d4
SHA512 107b9e57d9a8eb64140408662a8e9f3ccc6ef33993a7de5b9d370599b6887a10fba3ae8ca401d9ab860a2ff6f0d04e386dcc437f2f495722f08e457d620e73b3
SSDEEP 49152:oYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FXvYMLprznyDK:2ySzPdXvYCp3nyG
TLSH
T18B067C56A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 66801a719e91b575d7fbaa30e882202dc7f83ab6fc7b9abd794995ffeda55085
MD5 b3118000ac978cfd3c9f086a39ebfff5
SHA1 f4c9c533931780e2929af732ebebabd5af8adb57
SHA512 e697a36b37bdc91064e339208e1b31c4bf9dc4646be00a9469f586acb467afe34d7e1b81adad32b87a93f29942e3a714c93d85d7af4271900c96c8c3642591e3
SSDEEP 24576:647Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:647JUQj1irIhCnDHUPfF/1XvYMLprznj
TLSH
T10E65AE1DA3EC01E5E1BA923885154A1AEA71742E1F31CACF12B0837D6F67ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 8b2f2695787f7ba91d840aed4d28df43061f57ac3037f0a6b53632f4d397aa06
MD5 851b550cad251a25d118a2ac16ff2cfc
SHA1 a5664db1a5a8d391e5e3480fe0421458767d59f8
SHA512 c6a5e241e3d882169dc2fecf48bc1abc8f0bc319e80693adf6cf28e7eb44825a083386fb73b0ea1241077cfd1d9295d404dcedbf40f715dc0798d249c1c165f1
SSDEEP 12288:eNsf0LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:H0X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T11875F109E26812E9D52E6139CB914A05F7373C6583E1D3CB53D0F57E1F7AAA46CEA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9e50b7dfba328a44db4b602fea94301585822f9fdf6fe0603fb2647539f7a6ca
MD5 119c54ead72bd62850c464a7e453ffaf
SHA1 410b594c668c44f008495d9ea0caab910c5e1fe4
SHA512 2affda34a71e8553d98dbb45030351105626da9a3c55db4b5004e417a407f523b5257236d21ddda77c52bb7a08815214bdf9b55b788058c355964869af2511de
SSDEEP 12288:pYkaU3f65T0gNcL17xlwu7PWVLP9xt1a7:pYHUP6d61DjWVLFxt
TLSH
T1043507417666D75FC66D80321E32D2CCAB707D11EE04AF0373C9973F95B6658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 321KB
SHA256 655a2cd41ef42543944d6f79c4d1898415784d6e0f845f6238421ea2af9897aa
MD5 cdaa24442ccd8572a610c86918b26f1b
SHA1 065eb6dd8003223a8dfcfc669eda4f2187d05937
SHA512 bebbd8399562f9958c543f503e04fdb833c2720df9785e47d3ed1b0d8d5ac0fcfdaed3c7ae109944e5e8c783b2a660a5ff7f8a342a456e2ac16448bc1bbcbdb7
SSDEEP 768:4/TXnlToOlTPBlTz2+EQMUQ/TUjZ9llpllfnlToOlTPBlTz2+EQMhHjZ9llpll9z:bg9HxehH9HxYH9Hxj9Hx88al83po
TLSH
T16C647311B754F326C4B280B618B0D69BAB3DF527CF1247033BC91AADCCF2246A676B55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a38114d99b6c05875ae9468596abb7e823cf9fd18f4fe2b6bc2180f73cdd21f
MD5 734ed32369a33092e5af169a5f1c6400
SHA1 0ab00a2f996579fe58c514dc8b219803cba9de47
SHA512 04030ded30cf60d41eb3764dfd5642f0188adcd4a84f6e384aea7e06d243aaac8ef80b76c3db8872468f568e5519ff4453a83b9566726f9db3ac7fbd22e36617
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 40a0573a98553feadbf42be8360a84332869010f71c773faf66cf89da3a1e3a8
MD5 a3ec4ffd08f550a7310a219dd21db9af
SHA1 0720acbdf1752f6ca757b6cab0d8ab999ab61f4b
SHA512 920194079ea0fb7ab6f145e7de0f3b2e18b196e52e65ae8f91eb17e7493a1de9cd108d33619b9105b8a2378d5605d714da6511dffe781bcfea180eb20eac30bb
TLSH
T1D781A6180BACBDFCE712797550E240D93AFB8C6505479FA202FBE978598FFA81212731
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ba1f948fe850bb453adcfe73f7cbbb8466f17b745011738f5f5b1f8745883d65
MD5 9e828fbf8723c3bf8a98f8310ad2cdef
SHA1 ff54a33dd35ec8d1d3790ddc4d29401e64043bb2
SHA512 f3e1f37f83d812b52683bb9379e7266f0b5fde56f6f2a4255d1286ca396360b9373a188814699b12ae3c7bd7e63a0145e2b6dd1d8876fd734872ef590aacb07d
TLSH
T14351C95D5B6CDDFDC722A9B664E050D93EFB8CB905875F1203FAEA78490EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a258b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a258b.TMP
Size 2KB
SHA256 561198459cade96b6b391e992f2539a6a082e1224c4b5dd58deeab6b811daa29
MD5 ee34dcb2f3a9417df6a0faee4162b625
SHA1 b4ddfd65e2ff503837b5b7b0013c149b10ea7921
SHA512 40e5b481ee758e217933aa03d64c0b6b0cc24b809235da3f1cbd265f81059e042c4d5b565ce3880e9387a7b7f658741dfabd97c0014e66c3beba7a29cb948aa2
TLSH
T15651C85D0B6CDDFDC722A8B664E040D93AFB8CB801835F1202FAEA78090EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 0e1081c77d0ffd0492de372fa624a218baf45f4e5a72e5495717643aef8644e7
MD5 08b9504906c9eec8373807d961a02820
SHA1 446a03a480cfa08ccffa0f8ea420a42371983486
SHA512 02369f33b5e6819974fcf47e570a1508587be3d18037dc589c9c244c89ad57aa47d89f9521c85b50087912fd5c43ceccd8fe2fe4dea8073a0c68927b1232fdab
SSDEEP 192:DBJmye/E3naePWvgeuk2paMkOCxDiCR+D/AxvJn0+HDVRQArueHSxPP1dFrXr1yx:DBJmye/E3naePWvgeuk2paM/CxDiCR+K
TLSH
T190329BF783E5862DD91156F09A28AE1BCF1A0614436D3C39C9E4BE5BD3E2C72E101A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d44b5c0795a341e53f378e60f0b4b64c226686428f0ac69772419a7181d6189e
MD5 3b2c10634a2837e92c328c5ccd85c5e6
SHA1 3c1760210ba91d7c6389c56a1b97d52e79636763
SHA512 f459df46eb7103f7947583b8f77fe2c05dd3b99f79c56a0b758620b353a18a5f1eb7cac828c3d28df70a41bddaab088861bfe19fb25efa69da429da4312d83fc
SSDEEP 384:sxRW78v/fFsPC9pUtCDTP+/5H/33jHFVgQ8:s6Yv/fQCb8CDC/5fDFeH
TLSH
T15182E652A5346E7B8DDBD229F541BB27D2FD2423D5840E81ABFCCA1C10DBAED6102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9e6e3104b990af18651d9e6e386a3688821fccd144980136c03ab350ed52b22e
MD5 187d04083f1144685fee9bec7218b68f
SHA1 b77e434f95886459d27728d64dad3e8cc3384177
SHA512 284d707bf1865fb50228a96e11de507e89b17a77fca59568dd6944ae2cf5bf7759df1866aff4f57054c3ac22024837f83210ed9ad5ba3be82684fa6cfb2f6ef8
SSDEEP 192:sxRW/yM/jK1Ml8wCv/fFspCBp/MCzoA8pi/g6+WNIYZ7BKsVGiuIgVsJ:sxRW58v/fFspCBpkPi/5I+Qy
TLSH
T15252C7056A28993BCCDBD30DFA557F53D2F81563A1941E44AEFC9A1C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 6a52f858b6f046179b86f816513c54d9fc335b4ab2b46147893a0b5e7b87230c
MD5 0c438eff0db87761048bd78421224ac7
SHA1 0c893106c20673f61debc56371f6d255cadb6395
SHA512 c7c4efcb2fde4c1c7e5dc4652e5e6f0814214447bf006b7c9e14831e3b4d1dab5ed15c8c8e59df97f6feded4573a15848a59216e1e7f258ece411c1138c56e45
SSDEEP 384:sxRW7qhv/fFsPC9pUtCDcPE/5H/33jHFVgQ8:s62hv/fQCb8CDn/5fDFeH
TLSH
T1B282E752A5346E7B8DDBD229F541BB27D2FD2463D5840E81ABFCCA1C00DBAEC6102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9689aa38144c60eb35086e217ff75b46234fa007c529293dabe9b28588124f6b
MD5 bbc2235d3db707169de0d9c2b5a8be77
SHA1 8968463586a2cec81fa4fedfad47c876faac5bbb
SHA512 8c579d32f3ab20754e684743574493248d76a1958ce70a98821ccec8f028dd10842d882b0b7bae4f347993def0da30fdba9a328c0869620b98af0cd98ba5039e
SSDEEP 192:sxRR/yM/jK1Ml8wCv/fFsPCBpyZtErDOCzoA8pi/g6+WNIYZ7BKRVGiuIgDPBZ6J:sxRR58v/fFsPCBpUtCDOPi/5IXQW
TLSH
T17C62E915AA34997BCCDBD30DFA457F53D6FD1563A1940E04AAFC9A0C04EA6DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 620a2bf79c2290d655ada36a03337cb1c68140e887fa9791f6c9ba902574bacc
MD5 73554a51b6bfb49711abe2c6012f1b12
SHA1 46eed4aceac564d5da18ae80ebb5b372342b3151
SHA512 5a36462d573647ef7d7251efeec9a4b11119abffc56676f761ece9f6ac0dfc05342b60fb99bf923e51fa9a112f691660013a8b0d3d7d388361517c7327cf0660
SSDEEP 768:kfISRS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OV7SV2BroHh0P+TA:kfISRqE7CvWgd5fWbu1jasU26Hh0Pzb
TLSH
T1F8E2DB3B640CCB7F4F8049DCE8297E9AADA802CB96D8CD9447EA850C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 222f86755fa808d7c07747bf74833d4b57e2460c3cd496983fe758927a8c17bb
MD5 55ff2b3aa1bf37b0778888f0a08fde2b
SHA1 2141b08adbc60d85637b7c46bd9d84e0c7d1709d
SHA512 517ac1fe29a05a1e1645de1a7004d44f8cd4ab4de8aca4e9d7f9aced964a63470e64f667521744cd7b9b89ccb6842ffb670182c4c69159d829b0ab371807e75b
SSDEEP 24:KSiomEioOiovio7PiooSiopioliok1iopiooDioPI4ioDiokKXioHhPioFiok1Rl:KcuI/KvK0jyJ8IjKN6cRYIDKFSsby6
TLSH
T1CF911081707A42813C7E251995A2D666C68AB063346DE47BFBED00B20F6BF450FFC9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ab9eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ab9eb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7f20640b65465a958fb7f54933f89942004a9551011dd00b25ea37dd51de65da
MD5 7400d904dca4b10be435357205c614c8
SHA1 fb1a237cd2e2c03e3f522f0a148cb21ba267ba12
SHA512 d3d99c7b2c6a68cfd51311a2f4250bc0b059f2dec05c87691cfbff8eeadadea55bdc39b629a44eb65ca63cf2218522379516d4cc8b543a5b411b51ee7aab9de4
SSDEEP 768:UFQP3KwgsgeLHLiAam6aQMGdjWca4Ghf9BvP:3P3CmaME6pB3
TLSH
T1BCF27C31DCA4D97BACE7A785B75A7647EEF011B388DC89C4DAD96E0D019318E130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f7f8f3a2607086f83d01211decff9fb6c4c2375bfad43a6ffe87a73edc082b5c
MD5 a6e6215ff6d7d27aac8315dc4287c8aa
SHA1 ca256ec50544c557e9b1e19159a561637b1c7470
SHA512 58e48d6838e493a7f2dbde44eacaa17769d3dcc067125e41f16b7b8267ceae844103b936fa9275fbf081ed84ee983ca86337128b5cf308f673964508a33c7408
SSDEEP 768:/rv+4UNbdq3FGqsLwAAam6aQMGdjWca4GhfBMPeU/:/bsbc3DKmaME6pUH
TLSH
T1D8F2AE31A86C9973DDB79A99F21B6787BEF021A384D40A80D9D92B0D43974CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d6d79359471cdc15cec94455fae9328a80bc7d50784354f1107677969a8c0c80
MD5 343796e38b24a4bf913766b1ca27f363
SHA1 90e2d1de6a4dca43739f2d1305a830d39d84c675
SHA512 d9baa0629f253c55a138161aff2008279bedf05cba74489e0e8db4a4a9146bdebe2194d5184ccad0b1e0573fae59950308cf60e9bf01d3eb59b29ee8b9575bd6
SSDEEP 768:Grv+4UNbdv3rMqsLHLvhAam6aQMGdjWca4Ghf9BuY:Gbsbh3cjmaME6pBf
TLSH
T179F2AF31A86CD9739CB7A694F25B6687BFB4217388C80E94D9D56B0D02970CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 58711d08a30901a018bbcf0c1d35e3af72eb498ed87b2be6f885a5ba6ee9dd64
MD5 193cd0ceaa4d3435f7df2b5440c95d85
SHA1 c91990632e1350b7346e33d66adc0cf01702f012
SHA512 433eae6ee134edc7cdadc8a8cf7a12fb1214b16f3df994aa985939fe860939949bb237ee5a5ed375228a729179154abcdf670afeb91efd9b18ede51452237d45
TLSH
T156511A850AE112BBABB7BBF00A4196CD622B3A0FF2E9D4CF54D048B5657389355844E8
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe5a4ce9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe5a4ce9.TMP
Size 583B
SHA256 218bf8137f888e2760b90482aaa135bf569a9a2889a888d27cc3288e0770f63b
MD5 a070dfd4578398a7f26f46c93f537e28
SHA1 dd5588616421421f57156d996c395e6c46f7bff0
SHA512 8f5a7dbbe0dc9bab12f08fde32f4106cb594e76cc7f5ead939533b08af83c259c3fae74124d542edee273a1b041ad3e7a2390030a9aa2f89319e5d905954cac0
TLSH
T17FF04108F37FE5DCF6443636EC0101A9D06C30033981F285B8327236D1AAA2A7CE42C6
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e03cf940-978f-4b5f-ba7e-646782e20337.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e03cf940-978f-4b5f-ba7e-646782e20337.tmp
Size 30KB
SHA256 9809354be63c3168ddafa1a399c082fd7fda35bd54109fc3078654d36c3ca058
MD5 70d930329f497a6d86d65fdce667fe05
SHA1 355d1deb01f52cfa5fccae8cb590b903dd8999b6
SHA512 f382f07ff01209eb8cfe560ed71ce001aca2d9aa0696f25d6456d54f830cd1034cbcd1a6b87c1258c8d5e65f6d5ae89b297efd11c39c5416994999e296b47f4d
SSDEEP 768:jA33MqsLHLvhAam6aQMGdjWca4Ghf9BvP:jA3wjmaME6pB3
TLSH
T1CDE2AF305CA9DC739CABA295F75A2787BEF4217388D84D44D9E96F0D029718E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

1be29c01-6c3e-4561-bb17-4a31c0708108.tmp

Path C:\Users\Admin\AppData\Local\Temp\1be29c01-6c3e-4561-bb17-4a31c0708108.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir484_311294844\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cead62383aa041a0a6ee460e10f400e3ef03060587ddbf89432031be21586a88
MD5 12800d40dee0e8d64a9af9bd5756f03b
SHA1 d36c1ed0d7b20163a0ee9ef8ab9c0813f3d056e9
SHA512 755b2d6201cf7b99ae289f720e30e552a55399d89f8a9f38de130982cee50e986372b63b10a32f6ceab1c2a797b1d39933aaa4c14a81ea36906e3a245e8ad3e0
SSDEEP 12288:SF7cLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAjI:OcX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1AD652310B63C6DBBFF3A50354CF5440C681F3AD44B0495E7A38266DEA4FEEE8AC56219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ea0c58b1ead83c5adfa37bbadf5fa47f8a166b8b8a6f19b3c2e4e09521240e4
MD5 4abb61f2822719037310ca9b606abaa5
SHA1 87b74e152bb1469b93679125f0b590b97d5ad717
SHA512 8644108a774252c0878ae79aa4f81bfc785b902478f47bd0a57c1b73e08ac1dbbc4c395062081814118ddfe69758d2faf0f4311a59df6fa9ca01ee7b507a82ec
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:ogb4mBIBhGFXXvYMLprznyDSga9
TLSH
T1A165AE1E22EC02F5E1FAD2B8CDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 bd8d9f2dbe7c333866c4e6d9c0a2d49a34eea557ca07ad3726e3837cb1822585
MD5 d5efb7510edd053ce8ffde6253bfe5a6
SHA1 46e2c00eed2ad1e667e159daf140706be09179e3
SHA512 23bb7913e7f9a446a491973a5cf02f55c1f43190b5f6b2671b407179ce492f600bb1a91d2164781c53423e57d16d7883e12be5f3d1d65cb761c1e826a500f1b0
SSDEEP 24576:NG88u8FpJqH1bzria7/mnX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:A7ZFPqVea7/OXvYMLprznyDSga9
TLSH
T1A995012576E501F1E47BD13889824667F6B2B4250324EFDF07A88B561F23AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 33a89ac5f062559f625e41354469649090d78dd6f81244623a9385e45187f11c
MD5 fcb22920ba6854e97235a4cac2147800
SHA1 d724fe4e0fd3502c7ce28a6e1d878da9a1664aa2
SHA512 a349353acd69d3971fa75567a1a883c71602dd99ee9206776ad8db14cc4856bbd81aaba875a509ffe5fd3651521333f87f8e1e04a436e2b68c0e84d08521e4f7
SSDEEP 24576:HPUr+NQzX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:HJQzXvYMLprznyDSga9
TLSH
T14B85E12E62AC18E5F676A17D8982860DF77274620712D2DF02E1817E5F67EE8BC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b88130c92ede7c52b3fb5ccf5d29fe1178a51f322e38d34d19cedc26dd1d0866
MD5 c85156962106e66e5c0ca08afadc2d03
SHA1 c0129b64e808863d29cc7c7dccfed733aae2b63e
SHA512 83e531601be103e15ef9c1e5591bf6dd525601c2404a4cb82239ad08de9204b47ce3f3886c8311b2b121332a79f3263bb38b442970f0c734de9f1f88db847485
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDXvYMLprznyDSga9:rG05lO43bQXvYCp3nyG
TLSH
T15BD5CF6A62FC11F9D1BBD17CC9C64A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e6217f774d965ea3ea72ea82db0a7dd9728d0d0f754fe3454a4b10d4142acb30
MD5 63f8c608609fca5b9b1a787dc4e9ff76
SHA1 c68396a7485ec7073f4484fc0b94fd54c80d8340
SHA512 2e49d9ad1b0e18d695167031f434b84fa925cb090ab5a66e0d1ea17ac468d4cc1d5f5bc0f55acd149c81677108953449aec348a5c61c641173473740d077e9ef
SSDEEP 24576:Ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFX7bHsMQ4/O6yMLprOInyT/Swl8B:Wa5POZ3+Jt2pasx2+m7XvYMLprznyDSz
TLSH
T15F65AF5EA6FC01D5E579D17DC583460AF5B1346253329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1bb190baea924a490e02ebd2925dac94c7705216dd7e25186c911b009332f64f
MD5 98286dd100bd9eb5ebcd34b833393b90
SHA1 cb0c099f8ca9d1914ce19bd8b5dac7c521adf727
SHA512 ed2072139c72dace7ce224eb0d30878eb9d4eda8683c5bf46e423b33ddaf192fb83e1622e48385bdfa8cf917bfd60f0756f81dca88e9d516a4bff39ef55e752c
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7Fk/X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:zNc/zEOVHFuXvYMLprznyDSga9
TLSH
T182857B1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 efa1aabc1d895863e44f5806a27a9d4aa405b83bfd9a4f26d821443abe694967
MD5 8107d4fbdfb5fb3bff68033402e83c1f
SHA1 c2e69a188bb1dcaea64c9c3c7500a31e38a66f51
SHA512 cc46d4d420ff91486eca63f6c8e4d6579bf90e4cb73f77431d107fdb6429f4fa053e286c5658bdf852789a3485d44829964f2d79546d83ace9fc579491238b76
SSDEEP 24576:k8kNvNnaFeYhJNtmZBmpX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:k8MwBtOmpXvYMLprznyDSga9
TLSH
T1B855AF2EB6B846E4E1BEC675CD238512EA727461073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8318d6849903365c4905e76c19baa4db2abf1a73e18142bb4422fae4c819cfb6
MD5 ae50a4b1d129f35c99b812e6ef12fb44
SHA1 82ebad44b215956ec583ac3c485417e1f20fc664
SHA512 595e0cbc3c3f35a029d10612edf0230e14764494eade1684459e87808ff0f350fe0879080b72d43f8034972680efe02c67202021472d9b2548b3cb0d206c174f
SSDEEP 24576:HD3FHshBIYQgAAX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:HDVHeBIAAAXvYMLprznyDSga9
TLSH
T12F95E13DE66C04E5E57BD17CCAA38906E67138A9032256DB02D0C1BA5F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-97-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/472-18-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/472-20-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/472-19-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/472-12-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/580-372-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/580-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/580-99-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/580-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/580-374-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/580-105-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1136-79-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/1136-94-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/1136-74-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/1988-123-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1988-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1988-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1988-129-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1988-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2156-447-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2156-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2156-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2156-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2556-43-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2556-37-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/2556-36-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2556-49-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2556-47-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/3112-366-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3112-369-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3112-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3112-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3112-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3112-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4276-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4276-63-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4276-211-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4276-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4512-7-0x0000000000400000-0x000000000130C000-memory.dmp

Download

memory/4512-5-0x0000000003330000-0x0000000003397000-memory.dmp

Download

memory/4512-248-0x0000000000400000-0x000000000130C000-memory.dmp

Download

memory/4512-0-0x0000000003330000-0x0000000003397000-memory.dmp

Download

memory/4512-93-0x0000000000400000-0x000000000130C000-memory.dmp

Download

memory/4736-833-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4736-835-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4736-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4736-83-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4736-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4736-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4848-59-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4848-176-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/4848-51-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4848-57-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5216-375-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/5216-112-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5216-118-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5216-110-0x0000000140000000-0x00000001402FD000-memory.dmp

Download