d51643b2a81953e250db1541e6d46bfc2bf87db10457727476fd4c2f82e8a486

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 2.1MB
Sample260804-pajlaazbjf
SHA256 d51643b2a81953e250db1541e6d46bfc2bf87db10457727476fd4c2f82e8a486
MD5 49ff5fd4126a8fe1a3aafef3a9a99870
SHA1 5b071c4d70b80af4dea8a4c211ce6038b1ffc870
SHA512 391d8da665600f8cd608a3e756418f90ecee16d58ea7a46be143a1d9c60e1608a0b5f78ec0d794ecd8b252ea43eb37c9c5271a770aab2798dbba7b4f18986a40
SSDEEP 49152:Apv/7GfbGNM/u5CSbGLn8mNaoOXH5IXnCwnc:gUs5CEm4FpIS
TLSH
T1D0A5CF17F29680E9D01EC078CA06D535E962BC560B34A5EF06D8BB5A3E37BD41B3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2208	elevation_service.exe
3692	elevation_service.exe
2832	maintenanceservice.exe
5116	OSE.EXE
5380	PerceptionSimulationService.exe
5544	perfhost.exe
3376	ReFsDedupSvc.exe
4844	SensorDataService.exe
3364	ssh-agent.exe
4304	AgentService.exe
4472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
4464	verclsid.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c8aa8e9e83806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_255357285\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_255357285\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1421636688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1348495108\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1473697946\protocols.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_255357285\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2836_636323015\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_1421636688\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2836_693059746\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5156	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f07fa4e50924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009468b9e40924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000078da9ae40924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aabb1e40924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000751a6d200a24dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e22fbd200a24dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000966f86e40924dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002431ebe30924dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{603FAD5A-20A3-41DD-B8A0-6402F3D3AB46}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
2208	elevation_service.exe
5116	OSE.EXE
5116	OSE.EXE
5116	OSE.EXE
5116	OSE.EXE
5116	OSE.EXE
5116	OSE.EXE
5116	OSE.EXE
2368	msedge.exe
2368	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4120	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4304	AgentService.exe
Token: 33	4472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4472	SearchIndexer.exe
Token: SeBackupPrivilege	3376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3376	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3376	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3376	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2208	elevation_service.exe
Token: SeDebugPrivilege	5116	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 3492	4472	SearchIndexer.exe	100
PID 4120 wrote to memory of 2372	4120	2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe	101
PID 2372 wrote to memory of 4512	2372	iexplore.exe	102
PID 4512 wrote to memory of 2836	4512	IEXPLORE.EXE	103
PID 2836 wrote to memory of 5068	2836	msedge.exe	104
PID 2836 wrote to memory of 5156	2836	msedge.exe	105
PID 2836 wrote to memory of 4724	2836	msedge.exe	106
PID 2836 wrote to memory of 4724	2836	msedge.exe	106
PID 2836 wrote to memory of 4724	2836	msedge.exe	106
PID 2836 wrote to memory of 4768	2836	msedge.exe	107
PID 2836 wrote to memory of 4768	2836	msedge.exe	107
PID 2836 wrote to memory of 5484	2836	msedge.exe	108
PID 2836 wrote to memory of 5484	2836	msedge.exe	108
PID 2836 wrote to memory of 5484	2836	msedge.exe	108
PID 2836 wrote to memory of 5964	2836	msedge.exe	109
PID 2836 wrote to memory of 5964	2836	msedge.exe	109
PID 2836 wrote to memory of 5964	2836	msedge.exe	109
PID 2836 wrote to memory of 1632	2836	msedge.exe	110
PID 2836 wrote to memory of 5032	2836	msedge.exe	111
PID 2836 wrote to memory of 1632	2836	msedge.exe	110
PID 2836 wrote to memory of 1632	2836	msedge.exe	110
PID 2836 wrote to memory of 5032	2836	msedge.exe	111
PID 2836 wrote to memory of 5032	2836	msedge.exe	111
PID 4472 wrote to memory of 1168	4472	SearchIndexer.exe	112
PID 2836 wrote to memory of 2688	2836	msedge.exe	114
PID 2836 wrote to memory of 2688	2836	msedge.exe	114
PID 2836 wrote to memory of 5448	2836	msedge.exe	115
PID 2836 wrote to memory of 5448	2836	msedge.exe	115
PID 2836 wrote to memory of 4464	2836	msedge.exe	116
PID 2836 wrote to memory of 4464	2836	msedge.exe	116
PID 4472 wrote to memory of 5864	4472	SearchIndexer.exe	117
PID 4472 wrote to memory of 292	4472	SearchIndexer.exe	118
PID 2836 wrote to memory of 1392	2836	msedge.exe	120
PID 2836 wrote to memory of 5052	2836	msedge.exe	123
PID 2836 wrote to memory of 5052	2836	msedge.exe	123
PID 2836 wrote to memory of 5876	2836	msedge.exe	126
PID 2836 wrote to memory of 5876	2836	msedge.exe	126
PID 2836 wrote to memory of 5260	2836	msedge.exe	127
PID 2836 wrote to memory of 5260	2836	msedge.exe	127
PID 2836 wrote to memory of 2940	2836	msedge.exe	129
PID 2836 wrote to memory of 2940	2836	msedge.exe	129
PID 2836 wrote to memory of 1200	2836	msedge.exe	131
PID 2836 wrote to memory of 5580	2836	msedge.exe	132
PID 2836 wrote to memory of 3452	2836	msedge.exe	133
PID 2836 wrote to memory of 3312	2836	msedge.exe	134
PID 2836 wrote to memory of 3312	2836	msedge.exe	134
PID 2836 wrote to memory of 2552	2836	msedge.exe	139
PID 2836 wrote to memory of 2552	2836	msedge.exe	139
PID 2836 wrote to memory of 3272	2836	msedge.exe	140
PID 2836 wrote to memory of 3272	2836	msedge.exe	140
PID 2836 wrote to memory of 2440	2836	msedge.exe	141
PID 2836 wrote to memory of 2440	2836	msedge.exe	141
PID 2836 wrote to memory of 2368	2836	msedge.exe	142
PID 2836 wrote to memory of 3556	2836	msedge.exe	143
PID 2836 wrote to memory of 3556	2836	msedge.exe	143

C:\Users\Admin\AppData\Local\Temp\2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_49ff5fd4126a8fe1a3aafef3a9a99870_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" https://ie.2345.cc/
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" https://ie.2345.cc/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "https://ie.2345.cc/"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc1d41c188,0x7ffc1d41c194,0x7ffc1d41c1a0
        5⤵
        
        PID:5068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,8475717145623265137,9448775431888994389,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,6018918841558651759,2907873495167302420,262144 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:2
        5⤵
        
        PID:4724
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,5652494921116728088,15196148322267987708,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
        5⤵
        
        PID:4768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,2035147419906665923,5836502707434554204,2097152 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        5⤵
        
        PID:5484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,11086716806798539713,2774665920278218936,2097152 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        5⤵
        
        PID:5964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,16743813455816531993,5986404696297596414,2097152 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
        5⤵
        
        PID:1632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,7945431428858225013,1671820021443785825,2097152 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:9
        5⤵
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,17009933992085685963,9155412774880378221,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
        5⤵
        
        PID:2688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,5445587471231221970,3858704586884117586,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
        5⤵
        
        PID:5448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,12942790724172198942,12478914386016333637,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
        5⤵
        
        PID:4464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2238005206611660825,8565233309009697478,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2238005206611660825,8565233309009697478,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
        5⤵
        
        PID:1392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9103943750978887271,15822484474245828682,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
        5⤵
        
        PID:5052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,16708816261319162687,5768498948357606272,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
        5⤵
        
        PID:5876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,18115830367800676205,16010171829393156688,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
        5⤵
        
        PID:5260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,9292426074223174065,13891595770923171377,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
        5⤵
        
        PID:2940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,2813932415155094683,3315438231547641389,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
        5⤵
        
        PID:1200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11706643728350240518,13965263894343846248,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7970545881328101806,8409445827268046535,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
        5⤵
        
        PID:3452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,16741850422993777283,4053409512338083217,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
        5⤵
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,9370914357002839489,16192251197081699355,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
        5⤵
        
        PID:2552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,8536608144757900167,13679554249260256029,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
        5⤵
        
        PID:3272
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16309290475955679467,17000588328786259787,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
        5⤵
        
        PID:2440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5552,i,7367608105824405371,15087587418522679970,262144 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,1258066394134880827,884589348495349937,524288 --field-trial-handle=2816,i,16585584298940414120,1087173775313373021,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
        5⤵
        
        PID:3556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3692

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5380

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4844

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1272

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 915fce170b5851bba8631ab6011d9b173a7ac448b96b670dcffa6cc087b281b1
MD5 c6c88d418e91bacde333256b27ab1082
SHA1 fe7e37a86acf92922a209ffc41756bae74ac4d1d
SHA512 dbb29a7bc7d05b8bd936b968c097e582a99e2b404ffe86f23477f7692a522b8cb0650fe47a45779583475cecf14d162e8a625af155b6e39fa50fea8a03fd80b4
SSDEEP 49152:wb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnGOXH5IXnCwnc:a3q6tjBopIS
TLSH
T1B4D59C03F2D900E9E06AD178D7469132E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 c98b54657e8cbdf0412a56e38a07471c66917ef70d4ece6546659db583692d59
MD5 a7690e3ac5a55f0adfee5da22da598ef
SHA1 303adc23c7e4bc7284755e8ba18a6777cf36bd8d
SHA512 67297a5d704d5076e9fba6fb61b697fc23d5b1b92a3c942833b573cacddeb5f8fcb791bf3813e1e61f4f23f8c48bc75d6fd1345438b76d7aaa45ca3cd28d54ae
SSDEEP 12288:d1XLsswWkxy2lRq2czA3xIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:TXYfDtczABOXY05IXnYjLwJPT1lq
TLSH
T15C05F128A7E509F9ED67827CCCB18511EA337C954760E78B03E4AA660F332D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c568c07ad19c095e8c08c0ef2196f72d63996e9d462ee87e6debcd3e1f20eee8
MD5 18e2f6b4f53f6a35b16d18e7a8c72f28
SHA1 274fb607ce51d4fe172c57042ecbe7af47882f45
SHA512 6baee446bc9864c75bcb2aedd207ef9b054656ed5445e47144a421e389aa9d2df8684e10bc2cf43fad83bdb38043cf61575b2409e40f5a0ccd380ce427ceb093
SSDEEP 24576:T0Le5ji0hmxnrMeOXY05IXnYjLwJPT1lq:TPji0AxTOXH5IXnCwnc
TLSH
T1BE359E16F6748371D073C0B9C5D2A69EED7230865B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8ca899b8f9c70a2d3cb6c29eb6cbf1b24db462a4634c5048944de72706f60692
MD5 87437aa897c8e937286f7f9290a44a6a
SHA1 327fd562462e95265b8ba9de4a8afeb694b6fb54
SHA512 ffd184e4f0a93febd95c5b4ea7c5ee1faeced2fd456fd633fa6f0164be995e0e124effedfed34c45eaeeb5038c630a4bf05cd5a2879dbe7d8b10a06bc1a21d6e
SSDEEP 24576:wa7/ezSC6vUyDZaqgrvWx6q8wyu0OXY05IXnYjLwJPT1lq:n/ezSC6vURPvMHjy3OXH5IXnCwnc
TLSH
T166755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f31d5f02f89ba3b36d05af12560fa9173e8fdb1fd7e9006a9c327ec7da937b59
MD5 905beb60860b542f0d3691bd8e4b7e87
SHA1 0bd6dd6b5956d06997c4450b06bd0a1952b8bd3b
SHA512 85abab7430d4bbd4975405cdce70263e5c5e0fcef0e5967ca19faaf73ae1bbceb5334f196d4178432d43e2023e72908e099c80ff759b7cb6d74acca1c15c222c
SSDEEP 24576:HVbqPb88hv/lV7dOXY05IXnYjLwJPT1lq:HVO88hXlVpOXH5IXnCwnc
TLSH
T1EE559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 2837709b7081917edad5db20d324f8daaf5d26ba8f37d0c73b54f2195e5ce785
MD5 18cd1798161d853d0c4f06234a114de3
SHA1 b3b0caa0d123cb80d8b1f0d5a25870b144eef31a
SHA512 7ea2f09b4b7fc7975fa065cec0723e003f46b4b4ff0dad076b86366e2d01f90cdf6ec494bbca46449b2df7b9b312f52b9763aa1d883e9548a752ea28bf3afd36
SSDEEP 12288:UGmxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI26:UGaOXY05IXnYjLwJPT1lq8
TLSH
T163C4235ECB2922D3F72363BC6DF0B524981F4F948F69CC07C151F7CA0B791A588AA15A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5504d2420ce0127cfa0691c495a424aeb94b9de12e243fd43f50ab8256b68a51
MD5 5df3ee463c09a539beefea85a8852219
SHA1 0f0c7ff4b56ad8a37004c3be9b33f587326f6550
SHA512 8daa05aee6474c7d14172531810e6c09acab2d87c5c828a75732407052b1d3dc682b19c9020512df9df6bcefc3f7a3b1d6ac651479108b57e9db825a2d05c974
SSDEEP 12288:weBNUbTVO86U7xIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:wJIUVOXY05IXnYjLwJPT1lq
TLSH
T1EF05CF3BEE28FCD2C27A9DB85A918600D77278704F6293CBD165C34E8E235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2929f81da6a4a9e5c359659b66584e5e8235f9f90c9b4b08372d8cf2155e2cac
MD5 02f860551b6afdcc4db336cf3ef894c7
SHA1 c5db1b0ceae306535414ee40860429fd13edd8ae
SHA512 2689a614f580d868bd7246bc17c65bcca7a5cc736e2c40c441a188b2f33b8429c66e4ea3fcf79bb295231d12f1630cca1f388e9184fd3616ba08c4bccf894c9f
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THM:RQvGAdlCEL8c/pRNw5CxpIS
TLSH
T1CF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 b2fe9be1015db898f20c35e0a6048beaaeb0c8f1414e945e1d70aa834f027f26
MD5 d1d8abc9f5ac2a07487e7fe0b80358fb
SHA1 22994ad5fc7086f097f47251440abd23cf838494
SHA512 42a99b7dda18921670fe9ecf168d20156e5c842572e9d482d7c3e7c41087cbcc22c9bff80fe5d7e11716104f2a0d2f9ba5889ddee3e7d1fe449c26475616b244
SSDEEP 12288:NAwSfxL/2Dc3xDLLmt0LDQewsAjxxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0V1:+wewsAjjOXY05IXnYjLwJPT1lqb
TLSH
T19415E031FE74E032C37B0DB61B35D716582DBA604F6119C3E3A89E8E4A742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e13bb03357307c40c89dfac025720098d9b89fa97169c92391906d2c926a9ac6
MD5 fa7fd0def9083b353024030a3606c2c9
SHA1 7c39eb4275d1b1763a3b17bfd4e6dce364b1de68
SHA512 1516fd3b656385b711374ad134e35b8c507a7a74535d57835a2f2a3d373bad73b0771371b6a61c3a731850db7987e30441da6d1e34611f38fffb561515cef84e
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH0IS:DUEtQevvqc2W1cpV29I320
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2918fd2afb5d5e8b21baac918e32e13ba31a589093c16f33b040875494aeda1e
MD5 f491fdc0acc6d005553cd3b9dcbd7d5b
SHA1 e903a9c6125ee50557faea14c1dcaa48ea2d11fc
SHA512 3e1543744c41a346f6b15d410b6b457506d00ce10a6fb62c6440a8dfd2f23d380319e5b273e7f0751cad07368d810d2604264dff1dcb88df2ab15966667ab62a
SSDEEP 49152:8CbRquA/m2yL5zifFiV+XenmE3/zDOXH5IXnCwnc:1oqHVjnmVpIS
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7fcaef1a698a3a4af9a06f21e795dc78a846a6f60ed1e3a79d1723f1bab39198
MD5 6e8646d9506338ce32d1ef8820c7f48f
SHA1 1962ccce0de6952bc5a4e441cd54975045024bc4
SHA512 2941f6783fbd2709fef993cea71b45812b1a55f83af84dd273f4ce3b4679392454e33e5c85cc34918ebad80534a047484c31d7a288bb8a52d9bc64d59d238e4b
SSDEEP 24576:rAhGLmIFoiwtA5l7S534OXY05IXnYjLwJPT1lq:rAM1Foiq5oOXH5IXnCwnc
TLSH
T16335AD81EBF955D4F5B3ABB899B69170EA76BCA55E31C20F1160D20F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6b94b0aad7c70201dedc42abd48bb529156d61a073f34f095a5180c52dd3c2bc
MD5 dfa500ca698e1b122d4cc988596e2e5f
SHA1 428df7a5f4404a86f1ea2e97e69a0067e6bf5d22
SHA512 8a29b11fe4e3fd16886f331bf2c428e09263ceb540e964ede3f80b5dad21b843eb66403e6659c6ce4c66b820908b5071364fc01a283888a6b0aa2c107c83c87d
SSDEEP 12288:fmw5HEjsChNOBFgl0WDm+CoxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdr:ewuXOWXOXY05IXnYjLwJPT1lq
TLSH
T1A005F14A77A91CF9E96392388997D135F7B3BC012A25CB1F4360C65B1F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 98d18cb7c99a269d69abd8ee66d31dfd6873fe4352c1d79eb8cfa5f578944a8e
MD5 508a80dd5058ad2b9dcdc55652b18961
SHA1 dd95250582422479afe7b6eec868c4f4024ad756
SHA512 fad1612ded2a58c1a72ffc9bbd4cbceda096911e6355b03683c875687334761b6deea2c457725a5bdcc1cb6adb363e9492b98c877062ab3fcf3fd0496d040477
SSDEEP 12288:RbZ1IyBxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:dZuWOXY05IXnYjLwJPT1lq
TLSH
T121E4129E27A831F6E263927CCDF1A604D7767C915B7683CF4261A29A0F736D14C39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 68869d3c098aebce2c59cf496ba50665d97db124249a16b6e8aaf27da189423d
MD5 e497a3240953c689998a9f9f4fe31b8f
SHA1 eb78f801bac30532f6b3690df0a377cbe85c9b67
SHA512 d4316b2bb6b3b0d4330f9188ae5a9ff140bf07113b7d15659ee423e706ac614ab49a915132fe613da40963e54c34a7030fc0ba6ded69bd5519dc2b68a2752c0d
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uw:sQRQyi36YOcPuLvw2gAf+PN3kpIS
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c5e5f1830969e503e0e2cceb80318ea03c6b971ff9fdafc686b3fbfae8f118d5
MD5 1700ef19e59cf2fbd888c7d07c440538
SHA1 14a4caa6fedaf093170e451efc2fb059a7512ca2
SHA512 4d58a6e19d6f23f2a3b27119d4235c500b47a0cc0eaa94c277e395d2e054e5c4a74e8b07488f51945f5b1ff585bb8181f88e92f3684e6f3d23ec6e5813843f06
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uw:8QRQyi36YOcPuLvw2gAf+PN3kpIS
TLSH
T12C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 839976e3b817e25b497c736ed56db8800044d8bacc6458116db15d1da4a12c02
MD5 57693b329a3d70588b9a6fd2e923aacb
SHA1 004bd204dc2f2dcbf6cafd2554f7ce41a8d95493
SHA512 e139308143508ab1daf93fc6b35c06cef92427e9bb76535dcaf45e71722fd52e3c041e6fa7067549b1953169462d60177b15e98a70eb1918f686d47cfb8ccb12
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0GOXY05IXnYjLwJ6:968Qg55nhxeWu7PNU3/TOXH5IXnCwnc
TLSH
T1A9B54933B2F600A9C44DE1769F46973196D27C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6533a8f7caf4b5b883c89b0cb9a698dd19cd9b89a92867594a079795090cb2b8
MD5 d32d89881befad9db56e1e1b46b8c54e
SHA1 fb5e10873f510e51b40b0867347b05131f4a4f67
SHA512 2f8a1abef1b54041b2b12108c5263be820ab15d42cf87600514e3f715b60d3df96bafe839f12e03ade70520d3cafc2af4688b7072b86130f5032d0e8fd253b12
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:iy5112gYy5azzVvD69nLKnhZTpIS
TLSH
T123167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7ed396ffea1c4f7ae784bf3050eed0d0dc26501a4554c010e1e7ae720d295941
MD5 7b957f5f5c34005a4cf23fdb516db830
SHA1 596d6f79945d68bf588030cb22c5c35cc4a3e068
SHA512 c4f9d600936742d380128ae35b5bdfe5069880bf393c74672e40fd3af5eedb59f8d0bf704b74f80cea4c2d9a3d1ef350d98fa76433a5ee4bc0caa2d7dd1c0261
SSDEEP 49152:GB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glxOXH5IXnCwnc:0u6JmQxd2dspIS
TLSH
T14ED59D13F1DA01E8D06ED578974AA233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c417f7396ef7b99ff0611b1285478a843ba42d05c6893bfb96794e05407d2651
MD5 00d56a8e8cdb9b24b40826cfa4b3c41d
SHA1 bfdb38c2aacdaa6a84369708fcd595ad11048328
SHA512 f11cbb55e38eaf441d206472dfcbd68e6edd5348143131e8247fe2515561f0e4ded68f31c4d59174f586792b7fbe68e8073c5189fb0be8ba84ebd4490df7dda3
SSDEEP 49152:P1hpsNoJpF1A6yU44CwH7R4x1OXH5IXnCwnc:PmifPVRVpIS
TLSH
T130B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9245444e5dd719d0bef635150dc9f08bd33f00a2b26b01cdfccc0b7704530d3c
MD5 b833f01400f1d198ac82e244e27f68af
SHA1 142282bfa856d0cf29a39bc0cd7e71429935da44
SHA512 0b4c1419090cac24bc24d8e349a0d24786f70493068b6d16e6a7118af8155bd6b1544ea6d8bfa4b88be816925693495e27a8dc12e234b236a97f8aa2229c64db
SSDEEP 49152:QSuZQIY0Be2KIRVtOnks6NMHqWOXH5IXnCwnc:K5dKOi61/pIS
TLSH
T19AC5BE03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4a4c6c0e5b0eced5f909ee371a3241e6fd4a4514ae58d56440499154d131543f
MD5 3477ed9878f010ce63b6ad9e898aa9d4
SHA1 c81f4535c281ee5ffcf3f871592932c36a734c53
SHA512 3cb4e73023441425c1c0fdcc7da6fd7f0edaa18ad755c38c4da68e8561dbb62247c1db9758033f5f4df0a8f1cb3a38ab804539f09926e119329c013e82b7855a
SSDEEP 49152:OhtSn8EApI0figGgiDn0AP5wBOXH5IXnCwnc:PX2i/phJpIS
TLSH
T1E495BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6463afb3c1eefafbc1f0df9e13e7e0f93eab17aad68c222e86a0b813a131d8c5
MD5 9a4ca39659d8294c20e94048998af01b
SHA1 ba7c8d7241dabc93f6cee3f5f6662b12bf4bfa24
SHA512 ad2571070f8197b944ddb4247cb3994377280b749af106658d0327bcff76927570b7b0874b3b470106922280fcd8e0575c7a37f67f6ed21e8efc51969c7858d8
SSDEEP 12288:5OxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:5SOXY05IXnYjLwJPT1lq
TLSH
T1FCC4235ECD7E13D3F612A3FC9DF0B158D81E5FD48F69C80BC251F2860BBA1A5089A199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 18c10cb0d3190297c6d8e6a347a5ccb4682ef5415bfa1dafc426b43dd3bf9fd8
MD5 2edf7942f781ed0a0ea3ad029d6f2f06
SHA1 e21c69da209d8138a0d14ea019e4985204a687f0
SHA512 b7bbbfadfd5aedda28da99eede5f82a270cefcfdf0b890138fb505168d3f1519995089e624d0dc5bd5230de2046c992078e1e6fac0d6306982d2e960f97b99e4
SSDEEP 12288:ENxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:EfOXY05IXnYjLwJPT1lq
TLSH
T192C4235ECD7E13D3F612A3FC9EF0B154D81E5F948F6AC80BC251F2C60BBA1A5085A198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 c2e51abecce68c3a4e0705c4dafa2e3a8890a46d149df9dd37a4025e22bfa39b
MD5 3e8cd4c55b3b841b090d852026fb80e4
SHA1 ffbda380ebd9790e4b649c48d816e526f35fc475
SHA512 09b82a2d5083677d67afd02cc27f9d941c246e5eddbd1e071748f3b15100114d907c48423eb67a1871fbabeabd3f39bdc1651c6b5ac5cdb52b839c52acb34765
SSDEEP 12288:NDxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:NNOXY05IXnYjLwJPT1lq
TLSH
T1DDC4235ECD7E13D3F612A3FC59F0B154D81E5FD58F6AC80BC252F2C60BBA1A5089A198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 9b8c02349c24f2c8210304536e09f53f47a6e177e975c337f07844785e614eaa
MD5 ad0a55fceb4c70b84008d91781911c5d
SHA1 7ddd61489cba4ffc05c19f7f4a719c8c6df6cdf6
SHA512 d76abb4d70d9f0d59600f9fe934221f93086e7292b4b6ec4927842ebb396cfab49d8b91c2f724b578e99b62406a9958c93076db1ad94712c44cbd5d8b436293d
SSDEEP 12288:eVcxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:TOXY05IXnYjLwJPT1lq
TLSH
T120D4235A9B7E12D2E523E3BCCDB1A114D47E7ED48B35CA4FC201B68A0FB22A40C79755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 488d53a38cdc93edec0ff601733707fbb2e1718b4912d3ba39f3eaeaadce73bc
MD5 c15add15b30905810b87258ac85345b7
SHA1 4b2bd13ef25710e778b9c12e713f5d60a2f5e681
SHA512 86af7e59ff58d5af34d45b800f45a2b27161abe7f068d7ac700fb847c92fd0af97cf47c9527599499e8278e4cec22af64c31dc6720cd9d4b85f14f5a4004eed0
SSDEEP 12288:l0xIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:lgOXY05IXnYjLwJPT1lq
TLSH
T1B1C4235ECD7E13D3F612A3BC5DF0B154D81E5FD58F69C80BC252F2860BBA1A50CAA198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 76b51177ae661f1b55714e2a981bc62d90e934fcb57f9f135f34111b3651a323
MD5 9a8f5fe499a34d1113187eef9578da62
SHA1 847fe648e237cc60ba13471210a8ee78df2530d5
SHA512 d697b4c58b57db98e66f15e0fd31e7f6f1881aac1941e2b97faf92eb67edbaa665af6b2e0eedd3bce53d6d839b6cbb377be723c62b26307d64ba41805f53398c
SSDEEP 12288:RZxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:R7OXY05IXnYjLwJPT1lq
TLSH
T1AFC4235ECD7E13D3F612A3BC9DF0B158D81E5F948F6AC80BC251F2C60BBA1B50899199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 d06fe9c694fe038703a82e0cd79d68be53a1515e83d074d0c517a84ee738bf7d
MD5 4bc93151f3f68fad9f68623091f53c86
SHA1 587740e5438ba2fd9bd3bf36e77117881009e235
SHA512 0784f2960f05cfc89a5c9ee0e7d111cf1ce09a051d9d3b1402b7acd82ec7ba6dd43c32fa3b8536bd75d882884ad261c0cc629aab9fca2ba62ceface92a37b63f
SSDEEP 12288:XlxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:XHOXY05IXnYjLwJPT1lq
TLSH
T150C4235ECD7A13D3F61293FC5EB0B168D81E5FD88F69C80BC251F2C60BBA1B50859199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0ac3bb4192ce1251bfaaab35dc23ff87c4f484d21172aa48ee4bc785e9bb3fa9
MD5 4c93d9f26bbd3a85b716aa9f3ef26fd3
SHA1 7eff73110cc5b0d3987fd353a1d4eab352bbd54c
SHA512 a9bc6a8a31ca1514420175381abc74afa9f1daf234f56bcf3aab9fc1b15b7ea535008c89a177decec068ef2b208e343c59c38240e09e59356e9c4041c0ee90a2
SSDEEP 12288:eiZwbNzzFEoS2cPvytxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:BZMJzFVSO/OXY05IXnYjLwJPT1lq
TLSH
T187050299B3A018F5EC63823DCD619915D5B27C590B70CA1F43A4366B1F733A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d2f19c861d849195d3ac315e9c78882e66c2b2c092952b626dea9e55b8e20aac
MD5 b5dc284a2af0d2a346a830c2a4ee7ffe
SHA1 9de5111724521ee16057a6ce5cb7f60198a15ba9
SHA512 15a8936fca3511a569d17436a64c63352c654216ec6c3fe23f1ce1f17307149e1e9f9066d351fd25da03380c3f35b39022591c1ffda887e511ece8bcc1b245b7
SSDEEP 12288:kyxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:kmOXY05IXnYjLwJPT1lq
TLSH
T1FBC4235ECD7E12D3F61263BC5EF0B154C81E5FD98F6AC80BC256F2C60BBA1A5085E198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 446ebfe93c142c1edf46e880aa6e145ce0106f95f62245f768bbb9025e71c9a0
MD5 8ef6d2a716bc0770f8771a3c24fe8edd
SHA1 1182eb4e7f3f812b6acab7b041c2f33da9b51a53
SHA512 d80047d84ee1661ce287bd4565733fc74584b864c00805c147075da975d645e2a8a0c190e097da2d3bd180a98a866e9fcbf1083e706c1f0c988c9cd96fdd354a
SSDEEP 12288:j2xIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:jqOXY05IXnYjLwJPT1lq
TLSH
T170C4235ECD7E13D3F612A3BC4EF0B158C81E5FD98F6AC80BC251F6C60BBA1A50859199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 87a9f050d049d41b928c8fc398f674979d6bb598fd25b1d8a8b7d92c48acda89
MD5 f48c0b8bf1e91d2716d163990f999dd8
SHA1 db11121ad8290bcd7507b1aaae7e9db43e6216dc
SHA512 7a629f030748955f64eb46b59fbe14b05506254fc5db5c43c1c340b3742fc5ef53d7530e51cdfb55907d743c2cd01ff0513205c6c1ebd6cd924bd8557db7ac7c
SSDEEP 12288:SyPz5L8BxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:PzyzOXY05IXnYjLwJPT1lq
TLSH
T1CCF4024BA7A531F9E1239278C8A12A01F7767C754B24CA9F43A057B61F372E05D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e3e2c859b5086cbb037c6fa50983b02fb636156b47b88d49aeaeee8f74e9dfdd
MD5 12b5aa5ab2ac9e2331614f6bc7e3347c
SHA1 db93e4686a311bb964a8ae38833dda069dc8e0f7
SHA512 552ca20afef123000ff89337c4db196f18d1a1b5eb281f65d864a435cc5a832a4851a12f7dae09a1eb1f6502f2b3bbfd75c4ae9d28b8cc3ee4a29599adc1e084
SSDEEP 12288:0yxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:0mOXY05IXnYjLwJPT1lq
TLSH
T117C4239ECD7E12D3F612A3FC59B0B154C81E5FD98F69C80BC252F6C60BBA1A5085E198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 911c033b0d9c5068e5d8c623252eaed4e578918fecb87eb43dd00f95d3a5f1d6
MD5 c206d29dfb24fb4bbbd05a72e97b7a9f
SHA1 536df4e054c52d957bbbd859d3f30812ea9e1951
SHA512 37f32581eec881ffd887cd4656cf5eae9980f7054d71ae541936b504070d05605c8a992083aebcdf5421a7de7a3bc075434a4d51502414d9c451c6fe3b9ab784
SSDEEP 12288:8yxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:8mOXY05IXnYjLwJPT1lq
TLSH
T15FC4239ECD7E12D3F61293FC5DB0B154C81E5FD98F69C80BC252F2C60BBA1A5085E198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f3d0a1433239d10d6caf39cca9afaa1746a740a392b52e2a6a06f386f882ca80
MD5 c678fa3fff94bde837bb8fb071417841
SHA1 a1a1e77708c4236b60fbd7dae129c08a69fa7e69
SHA512 28e55c34b18db82d19a2acd035be81f78d3f8385be71a244df990e874051261fea98f3b67862a01e0c19c34f7cf261f340e971b73605847bbdcdc132fb7e7f07
SSDEEP 12288:cyPz5L8BxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:FzyzOXY05IXnYjLwJPT1lq
TLSH
T18BF4024B67A531F9E1239278C8A12A01F7767C754B24CA9F43A057B61F372E05D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 227674adaf24854bd136f5d479d8c38ad7627b91719afb33565aba534bf5eb4e
MD5 461c55208d86b3302b50721b9ce17665
SHA1 787ffc52309883baf6d725d5c402cfe750e9c250
SHA512 5c38c28b69a60223d43f9c6c13a78b8163b435226d120de7bfa83bfcba3ffa09109fe24ffa59cf3c6632f3d2981ffdd8f1bf5bfb06c8cdf2ad748d35cd153e4d
SSDEEP 12288:nCd9XWYoaLHF3z0z04PDvhzxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdr:CTuaLl3z0zD9OXY05IXnYjLwJPT1lq
TLSH
T19F0502A9B36018F9EC63827DCD619915D5B27C5A0B70CA1F43A4366B0F733A11C3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4059c714ecc818e244eb22fa6d4b3bdc67e534d3ebf321d1a84e396424220485
MD5 781d554fb19117bea4c1c3ccbbbfe8dd
SHA1 0a8986a1fd22e6da33c32844d6490349a2d36780
SHA512 0d69693d2dfdc6294e91facdf149b0930c4c3be21e3deb24dd9e6e45fa8a548286dfdfe186b02ceeac3c5b96f9be6c9acc74a7f1910b4364162b3890e45832ba
SSDEEP 12288:ji4e7URdTfgwCHKy7GLbbdIvAxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0Vclx6:j3xd9CHKy7GZ5OXY05IXnYjLwJPT1lq
TLSH
T1E225CF90F3E810E9F1B39A398D729511DA767C991B31CE8F03A4665A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 522422bbfd36d56260e67f4aa7d10b19f0a6f58bcd1742e675484abccb9c4661
MD5 91cf48fe642804d6b1a591fac1216a7e
SHA1 ca4abf8e4d3684619a49aa555eb1b84f1e07b897
SHA512 3ca86340c0b1c4c42a4f8d7ce974e17f6db18a7e57f6ae2fc1f7b0bad5cd89df28ab2d05daf6c55d5e9dd8752543235f92f7d272cf20d966a6fd7c95668b385c
SSDEEP 12288:ijxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:itOXY05IXnYjLwJPT1lq
TLSH
T102C4235ECD7E13D3F612A3FC9DB0B154D81E5FD58F69C80BC251F2860BBA1A50CAA198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7a1f61ab48b8407ea1e668801b46addbfe8303c0d8dbf1fd4338a225874fff8d
MD5 9307b8c7fbe444fb168e9da0d303b9a4
SHA1 1bb6acf58282a76acb1915de174269d8d4f28adc
SHA512 8dcf1131f0ff8776fec7a30b53072105ae2752aae070366c09184ea0c6e7dc1a9d362969cce6f810ceb3217482398ca1dbf6dc23bc3efa08b0b82bed1a788c75
SSDEEP 12288:6hxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:6TOXY05IXnYjLwJPT1lq
TLSH
T14EC4339ECD7E13E3F612A3FC5DF0B154D81E5F948F6AC80BC252F1860BBA1A50C5A199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b04f49b7b8cc37edf0491439d69ef0c762c7345945841aa221aabc3e5e3f81d2
MD5 0904741823e061efe752e0c8a6b525b6
SHA1 f11c7dc299d2951666420cc080b5b45edf367c07
SHA512 dcd45ec989b3e9b9ed7dc949fd2a21d93f5ce2da759f7914a8dccbd47e4f9f71b2e8ab8009303ec65efbf7186540401b8ad3437858140832ffaeb343389aad0a
SSDEEP 24576:GfwvOk9RX6wkyAI6OXY05IXnYjLwJPT1lq:wMnYI6OXH5IXnCwnc
TLSH
T13235C029EBDC04E5E177923C99B3460AF6B178591B31C6CF029A53AE0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3603f8380adef68eb4088aadd6663f62ae2c95c452bc9901977e23a29c15206a
MD5 747259c978f525e53b7c8423604a1d12
SHA1 b09b5ba0bb8c067ad6243e145c49261f1db9d6f8
SHA512 9529bf87dc26dd627e621f8a491ad88b9f1d55082f7286cec9fa955680f559f2beb5c78e51c14a00fc3d69ab17fbf44ce514c33870993a9acf2da0ac53a8d273
SSDEEP 49152:2YjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hOXH5IXnCwnc:eySzPEpIS
TLSH
T151067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f9de56e4dc98675c5932c876d6f9fd95d0bc993a09d3b8d151c1c5e2a3c77a06
MD5 726dbdebd9988fd96c91b29dcafdd8a7
SHA1 dd33e71cf9cd11aab1aaedcfeaeb68edba346d2c
SHA512 da35244efbfd28cd06f347664873289cf22d7ddb4318da7b3e28bf77643c1fd926950e4fbc77bdc825686b6a2a52a8bd00cb2f2f5954a16c79d2356efad55575
SSDEEP 24576:/47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYPOXY05IXnYjLwJPT1lq:/47JUQjairIhCnDHUPfF/xOXH5IXnCwc
TLSH
T14765AE1EA3EC01E5E1BA927885158A5AEA71782D1F31CACF1270937D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1ef25bf2df26c4368296c5db432206e18dc6d2b02b911d3adcfedf50ed239fb0
MD5 97f64912abb0582287f70dd9e98d24e4
SHA1 659fda3658f4a3d3a24c05d7435ff40123780008
SHA512 6d8d1d53e761dc8a6c6e10c55864a375316632b6ca502b090b536ddada5b88685dfc6b4106a53cf689fb219f6ef7c965c001b956d33f244eb65c316d56a1ee95
SSDEEP 12288:KksfixIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:QWOXY05IXnYjLwJPT1lq
TLSH
T13CE4F15AD2A812E9D02E6278CBA19640F7377D6587E1C3CB82D0F57E0F762905CEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 f7dac3e9ff06b2a6ea2f8b9536a27b5fd18271792cc6686fd885fe72d87de834
MD5 82aa3e02c04d8bcf8568110972b30b49
SHA1 bb8af35e243cbb8693e7f43cf383321b35de8891
SHA512 3525619d91c04d4c210ed3af85aa6ff8c62dfb899695e0fea83e6c3c341ea42d30cbe5646c44b3b56427000deb9176a4ebdf1f7cad2a8758d1274a9fbeb7b675
SSDEEP 12288:gQqzU3fvsvwKHdZ/QMQSeX0bx3YCaLPXkHKOm:gQQUPvsv99KsP9FaTUHKOm
TLSH
T14D250710766AD75FC6AD40325E32D1CCAB707D01FE05AB0372C8972FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 325KB
SHA256 fabe505c3373ed9011bb41833c906ae9836ec2fce573dbbcdc546a654a008b34
MD5 06178b36a1eb17c647a97d6b3d08d6c3
SHA1 56fa7c87640e6a3947c25a5c79246b28a24015fe
SHA512 a4ae9bebcf4a25b8836d0ba8c5830935c796ce505e16f18a072945375875737b40cdc49f81e7f364293fc5d94e4a16999365abedaa382867eb55e29f244e1a6a
SSDEEP 768:VrlToOlTPBlTz2+EQMy/T5srlToOlTPBlTz2+EQMMM/TvrlToOlTPBlTz2+EQMY4:ym1Y7VNUDxgfb
TLSH
T1FC647511B750B229C4B6817798B0D2A7EA3DB512CF2392063FD81E99DCF2147273AF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a5a21debc3956d36e4340d58b9d53e709a6e68109ca1a1dd2170164d5ced1e6d
MD5 24f6d6f72c9e284f3545a3382a749ced
SHA1 f56593a45b233f69a23a9e86d7959c1f70f05db5
SHA512 2d2d7ef52ebfaa5ec979db0aee34451b6e569347661c85832c4dc80ad5bb4050c0022bc9132184eee0f7e229d7068081389f864181ab51fc3d4b7c86dc43fd50
TLSH
T14B71C498F32A0BD8EB266ABA50D25467B6F4A531030B5E040C633CB49673F8070E3B63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a063b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a063b.TMP
Size 3KB
SHA256 8a6823b2c237241edcfd577bc48ea8566e6ef98effbaddbb20c3f17b4984163c
MD5 615af144606561cd2b88044be3b768e1
SHA1 cd1a1a1227e34d21904678dea4b993a69cb715a1
SHA512 47785634cdf49c228d60e1ad97ae1857b465eaf075343df2ad4a69b1310d9dbd9e2c8f83433504bbc55928eb858303935f30723f07f9bce3c7a3e6ba6e32f49a
TLSH
T15761A498F32A0BD8DB256ABD54E254A7B2F4B521030B5E144C633CB45A73F8474E3B67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 403a4580f8419f8a23eed3fd0e0fbce304635bc6212f251b41d16440bbd681b9
MD5 a06d95c116f0bcd21f83ab2a969c0be0
SHA1 f1bb7b15ece3e257c95e9e41f30008dd7144c3e1
SHA512 af14721ec7c4a09a30513e2a7b82ae38364fa7784c1d0cb857e2bcce085fa233ee62bbf1a5e047bcc7fe6fc46596ed5b096f2fbdd8f6d51392c6e4a248e8572f
TLSH
T19851DDF783F8866D9A0196F0AA147E1FCE5D0521432C3D5A89E4AF1B93F3471E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ff053122166417a22c769259e8644253e8af8c787b3c633beb1c0c7a810d3775
MD5 69572dec503f07878154c1eca998494f
SHA1 a4713a3ac961578893b2ce6f5b2f97a4c38b5ea3
SHA512 312a5f9262c0dbce033805d1f0a583110f1fff9835fa78f179791a0231f34b3a218d832da84e475224455aa58b4fe31433b968b87c8c6847ea1b1eff21009737
TLSH
T1BB219DF3C3E8567D894181F866182E1BCE2D0955832C3E5AC9D4AB5BA3E18B1E25095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d0e836b5454ce465a072543bb5773c833c3d0811f600fb18f4c25854efb57e52
MD5 c553fe1304346df089958fde754b72b2
SHA1 9a72e591baabefa988203ed86266b949bbb6beb0
SHA512 6358a456fb92e8d9b4a40128799ad3e96b6af1b567fcd4f627adbb54e5ab0a50c9eee7f8366163ef9a74368632f7de5e8235f91a1df8f96e0f92be9aa503fdea
TLSH
T1A151DDF783F8866D9A0196F0AA147E1FCE5D0521532C3D5A89E4AF1B93F3471E141A8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 949c4db69a311f9f94553c23f5702e180a84add079efc3a3150845c45a4d2c4d
MD5 947e1f82226429f4400bcb83292fb07b
SHA1 732b5d722e864a22ca72b907062350c4080d3c86
SHA512 0c13845ee0a8f302eb0e9cd85524e3323fd40d407f1fd842af1214883887b2b4b2f8dfb5e4cdd8ac39b53eb8851bc8115889bd72683b814f0ecf735613ee031a
SSDEEP 192:sxRerCy/fss+Ko3biZzLS4zoA8pqi/g6+WNOqp/MUD9x6SB+G+GCIgDEBZhJ:sxReey/fss+KoLkfSBx/5p/iSBkDo
TLSH
T1AA42C716A928A93B5CCBE21DBA567F53E2F9607260941F44A7FC9A1C00E77DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 64e1a63f44a35d653dfb1c55ea5719c822978c87c7828b35b6991cab78c9d809
MD5 dfa5ec6a431109de45e8b73eafcb6d76
SHA1 d02652b48e15059240d6efe7d4314aced7c724b8
SHA512 7f554e594ad60caac7a0b35eecf9033cde743c5dc82fb3c7fdc3d52561babb55fcb3bd23dce1588b5102fb331ba356f753c9ecb51f2f6fae5d3c4fa61ca51e77
SSDEEP 192:sxR1rCy/fssio3FKCA94/izoA8pqi/g6+WNOqp/YD9C6SB+G+GCIgVlJ:sxR1ey/fssio1Z8Wx/5p/2SBkDh
TLSH
T19932C816A928AD3B4CCBE21DBB55BF53D2F9603261D41E58A7FC9A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 767c66fcd59dba06a2182b0487666cf0206d0a8c65c0850653ee5b4e97f88692
MD5 554f462b67a615e1a60b5642872c4696
SHA1 44293d9f4dd596f496f047517b2a17868a648d7e
SHA512 111fb91047ef40af712235c21b7e53e6dc4487e619ae2617ab2a421114067fc4d7edb72f8fccdd74506fafa5b942bad3985b6557f75757a65eaf76ef6c0c58a8
SSDEEP 192:sxRerCy/fss+Ko3FiZzLS4zoA8pqi/g6+WNOqp/MUD9l6SB+G+GCIgDeBZhJ:sxReey/fss+Ko1kfSBx/5p/WSBkD6
TLSH
T16C42B616A938A93B4CCBE21DBA557F53D6F9603261941E48A7FC9A1C00EB7DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b05372a807f160d48c603c1a2262992c86abad2ac39e183fecd722123475902b
MD5 85ffecf6a3456b971654f2252c8e579a
SHA1 033b8024ea61153bbb293ab61b7d6e57d2756c98
SHA512 87f471427cf99a3714abff5ffdf84d0eaccf18c78a0b8e752fd0e7c63ae9d3e53a16cc08642105237b89a6d2557a19f8b19035151bf69e041f17e51d46d11fc6
SSDEEP 768:azfWML7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVac16iropLbxxb:azfWMdE7J0Wg/XfHfu1ja5y65pLT
TLSH
T161C2FB3B640CCE7F4F800ADDAD197E9B6D6802CB969CCD5047FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 39a36b4c841dbb25234b533a909269e543649663bf2c0e68704778fdd8703f3e
MD5 14fffd43a08b850c0b8a23d8460a9034
SHA1 0d7770801d295beb42fddbf6777bd2e6059f81b7
SHA512 ea3337b1004cc36ceed7ef812a7c8dd001fd58a4aba4c55ae6ce73d8befb1059207ea0f2dcc7f521021e224add63fcc0e3c36aeb42ce3b3bda57f6f6a905b318
SSDEEP 96:KRB+PrZ7/LWPM6gTLK4ygdLcBpk3/4HklQUuSW0Wyf/gc0K4xgW0cUUfOn6MKPaN:CB+PrZ7/KPMrTxygd4Bpk3/4HklQUuSV
TLSH
T1D2918855727E02803D7F660C84F98D2B8682B4627416696FBBA842524F67E13CEFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9adece1-27d8-4006-8bf2-bae570dc0443.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d9adece1-27d8-4006-8bf2-bae570dc0443.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 16912553be1be8c209d585a32bd2a0f2018f8f167584a5a5da73431b43d1c9f2
MD5 2fa61ff35b6edf98ce85443549b75c90
SHA1 0f30e28570b9ebe788e0505a1ff64c361e2409a1
SHA512 50ccc72a3a742e9eabde33254297e7a409f79dce6764ecb22220de3d0aad0570b6a76ba607787a7a68c161db15cf744b5c8c164b0004400134e3b892f6ca16d2
SSDEEP 768:uz3bHGi0VRPWrEnjN3Gac1FtojKgqmUAX:uz34HPWQnjMaCfgRUAX
TLSH
T1BBF2BF702C65DEB38CEEF38575827793AEF0666395D44EA4D6CDAA0D05436DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 42c0e62cc3a5f32bbb4d1b3914916dcc6b9f64e2e9cc1c9a860c22105cf120bc
MD5 3dc4c9507455372655a3698b11edd759
SHA1 352e5d64fa6874eda6ecc38e714db98fd29717b3
SHA512 85aee552bca36121c4ec976946071af086328da6c135e70ab50cc683acfb513d1fb63d1baacf7e38878813e569e2901cd06f689f2d1fe82a69a4e78c1a8aa994
SSDEEP 768:DF4O3iwgoH0sVRPDrEnjN3Gac1FtojKgqmUAX:WO3THPDQnjMaCfgRUAX
TLSH
T16C039E759C64DEB7DCEBA7C6B6467683DEE012A385C88EE4E6C96D0C00835DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 40162202b5bcbce72456068483c18cdeadd4f929c5e9660996dae31e8b926b54
MD5 6023981673bfaa6436bd27789e87512f
SHA1 287dfbf4bdf4f54270caf0003777d7ca9af240c1
SHA512 10b571b17a406f4aab825cca46ae727fb80d6481798e6dd963af9790eaf261a32e62b8c568fc68b97062260f7bfc0193d29037e2687ba88b6bf2201e0c628f80
SSDEEP 768:kz3AHGi0VRPWrEnjN3Gac1FtojKgqmUAX:kz3jHPWQnjMaCfgRUAX
TLSH
T111F2BF702865DEB38CEEF38575827793AEF0566395D44EA4D6CDAA0D05436DC230B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bc7d5b56b02b8bb78a84e4add91e2d0438edec16c462181a6bfa9c5959c992fb
MD5 a7739ca8ed85401c60ef252f471ddf04
SHA1 83388988c35b2530f8f500f8e7916c7bf9597e38
SHA512 d37b8dfa3a9bb9b1b2fc06709bcb5595288c605ffa44dcdb051982a4a8c090f5b720c3271291860e8eeb467b7547ed6935336a418ad7ad9dd001a9a6d553fb88
SSDEEP 768:Wrv+4UNbdS3pfGi0VRPdrEnjN3Gac1Ft0:Wbsbg3iHPdQnjMaC0
TLSH
T17003B0316968DDB38CFBE385B1477693BFB416A349C50BA4D6CA6A0C05875DD230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d5cd5ef20b937dd07f4ff7712843cc82fb2acdc3eec4341831ef4552de8445c6
MD5 6a615729e2fcb54f55d7943bc77182c5
SHA1 74cdc4be28aea0061b712a4fea4517cfaf82e741
SHA512 47d8c32b18b000c8151e5ebc0901b3537db1e0221ea1b699623f56e0fe2170ed60c029d59c6301426f0c396a246902d110a9e47ff9a63740ca1543d4593398a2
SSDEEP 768:rrv+4UNbdS3pmi0ZrEnjN3Gac1ZBeVH1SCz:rbsbg3OZQnjMaaEH1V
TLSH
T1EB03CF3669B88EB38CEBA385718776037FF4525386940BE4CACD6B0D06975EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 04234053de5b12b04c22e681b69b5fc4a0c450fef04ea8aa63cf7481d01ad91d
MD5 421b5d60314ea614a68a47c22544a950
SHA1 d6fbdde4eae8bd6a6b1a969ab9a8426eeb1d8b9e
SHA512 cd14637859a57b2038f218f53bc51c414d6e0f69f5e78c5c8a3abfb2f68de6720832ed8c2fa89438f4e730344e7e873bffe913db3203a152709cb7ce5c4764cb
SSDEEP 768:orv+4UNbds3QfGi0VRPKrEnjN3Gac1Ftl:obsba3ZHPKQnjMaCl
TLSH
T19203B0316968DEB38CEBE38571437693BFF426A345C50BA4D6CA6A0C05875ED230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe2f6f34-e0e8-4180-8156-de313ee19b33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fe2f6f34-e0e8-4180-8156-de313ee19b33.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

9d9f22fe-7319-4cbd-b4d1-dd034dce0f86.tmp

Path C:\Users\Admin\AppData\Local\Temp\9d9f22fe-7319-4cbd-b4d1-dd034dce0f86.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2836_1431610785\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 6419d8b27f1d5f7d8fc0db17213013605475be3cc821c3a7073f0d68894f46ba
MD5 05393ca29310af47816ab5b9d10090c4
SHA1 6c5b4184d3f4cbf3886e3ee55557e67d764d9f9e
SHA512 72f42cf17202ad64bba22c989fdd9f640a2f1e0d19b074059b71a0ff773d7ea4b2447fbd7a20fca00f58fd0097e23da0d0169d450ed82792b7eb46afc31936db
SSDEEP 12288:bz76xIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2u:7+OXY05IXnYjLwJPT1lqI
TLSH
T12AD4235ACB6D1693F53263B859B1F134A41FAFA48F64C8CBC101B6CA0B751E54CBA24A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 528ae62851bd1918e37e64326b4d3a4c1ea064c0a0107b3bb9f3fa5df3232e12
MD5 d7b4994e71fda353b82de2662368fd71
SHA1 7a931db85bd9b67029fd339e060dc9eaa0cc22b6
SHA512 6a76d0a02221b1d918a2d488641a5866bcb39831d557f9cd6a8559df34f732ccea85fe258b1c47151f2c8e48521324242250dbc152fa96321e21a33789206ec3
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bY0OXY05IXnYjLwJPT1lq:igb4mBIBhGFPOXH5IXnCwnc
TLSH
T1FD65AE1E22EC02F5E0F6E2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 617c7f9bec8b6ec85ddf43c9355ff7ed5ecd855784be1cea61fe89d185f22276
MD5 8c6b58612564f85c33e8f7793a4088df
SHA1 341c80a77f29d1190d5899d3cde668e8578a54ac
SHA512 1483a39a935698796a24687fbc479a334f62bcd56e4d33329a9a842c189da4929515a75a5b947f1b0daa856c4f13fb416ed54e7fbc6df3ea9a458e6410c1fd87
SSDEEP 24576:VG88u8FpJqH1nzria7/m/OXY05IXnYjLwJPT1lq:Y7ZFPqV6a7/8OXH5IXnCwnc
TLSH
T1A8350165B7E102F1D477D1388A924663F6B2B8250364EFDF07A88B550F236E50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 4bec8d13c442e4aaab3ac7f1124d5aa192c5e7b9e4ab8abf38087366c50adee4
MD5 39dc7c969f112ca8e4e2a5a87fe038a4
SHA1 4cee1334827b5362f1ea62d8e5f433ea66ea791e
SHA512 6803d5716f1c31008bbf52d4f9ef69ed9976092545d530cab93db5533b0ab382db4eb7e086b06ba900aa0fa9c2fdbac3683b143a08eeff19bd7c16fe8e7bb8c5
SSDEEP 12288:IHvUrBFrEjwaQpxIJRXYLQ/xTrIUYRnYjQmnwNYL2PF4isS0VclxQdI2:IPUr+NQLOXY05IXnYjLwJPT1lq
TLSH
T11A05F22F66AD18E5F676E17C89928719F77278620712D2CF02D0917E0F67AE86C3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e211bed8a774c1525a396718dc76c07bcff24d1097209fcad136cc7d60f1e4eb
MD5 596631b7c56995b06a0d6bf9c05c26fa
SHA1 39520ebd0bbd9c9a8e4057a81e87a3fceee0fc00
SHA512 acca9ba07269252e1c475d446c431f90804f8a7ad79e70a00ad9796f105b11e820b91b1b41625a6e319f126d949465ac15ad1f3bb8134fa20481c9f9c109701d
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7OXH5IXnCwnc:QG05lO43brpIS
TLSH
T172D5CF6E62EC11F9D0BBD17CDAC6860BEBB23815033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 098abb8208c38d2013f669daa992ac14872131ec5ea4d085fc71dc12a784852f
MD5 09ff18bf70abaf4985e5ad21398058cf
SHA1 a58d79ca1dcdcca9c2935aed7158d811e313ccf9
SHA512 4885c77709f0c0692d9ce784747046aca549e024eda7084c1dc4584b2826d3a5b047c5f0d80563f978bfc017dd2ec87310d529b657d8b08bcd42b6c1e93114f2
SSDEEP 24576:zfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnhOXY05IXnYjLwJPT1lq:La5POZ3hJt2pasx2+mTOXH5IXnCwnc
TLSH
T1B565AF5EA6FC01D5E579D17CC583861AE5B2342553329BCF022182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fcfabf74699cf018c45c0a1631043226dd34acd7a217008620ab9e7f6eac8819
MD5 bbba57cfca2eeb73810e33de63386a10
SHA1 ca1258e6e6485ff61648be98e9e000b168a5c059
SHA512 e3d0cce9a4708123e8ed629df61e92528d30cb219604aa487b9a3f27e8ca3a52b548121504bd919571435eae51017886111b1d2e60c816b80615ffe9ebd9198c
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7Fk3OXY05IXnYjLwJPT1lq:tNc/zEOVHFcOXH5IXnCwnc
TLSH
T121857B2623E901E4F5BBE1BE89779546FA71786517308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2e3bc6367c5d0308426ccf20205440880b28313d408f6a8e2a9a7d96a9d2644c
MD5 9525f2d7f74ef5d6c292fcfb4a601090
SHA1 9b676aac3724daa7578d880729ec4c3a22d495d2
SHA512 347f3a2f25db9b13bb3a8b56d40d647af4fa130de86fed70e5cfb536618acd0b504ea824de58f56227ba4aa1e96e8043d3672d7261b3f31187da46b5a00743ff
SSDEEP 24576:d3kNvNnaFeYhJNtmZBmlOXY05IXnYjLwJPT1lq:d3MwBtOmlOXH5IXnCwnc
TLSH
T12755AF6EBAB846E4D1FAC6B4CD238512E6727861073293CB5390C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ef70a3701a64240c530dbf04c63a4c6bd6c3aa7b9d56ac47e96bf9b986186602
MD5 d7cf554a556ad2568831eec1d6af772c
SHA1 90bdd7c27cdfac92f9b673e7bc64a375defba1ee
SHA512 321cb83e483dfb3c57b68d49f9f0f47e0d9788d484aa8a5e1e7771b23b5ffcf8b2da658f824a9efd3dca721c4ef33645216dd240740e15a7718dd54a129ef2db
SSDEEP 24576:VD3FHshBIYQgAyOXY05IXnYjLwJPT1lq:VDVHeBIAAyOXH5IXnCwnc
TLSH
T1A925E17EEA5C04E4E57BD1BCDA638606E67138A9032255CB02D4D1BA1F6BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2208-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2208-15-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2208-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2208-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2832-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2832-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2832-75-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2832-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3364-115-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3364-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3364-404-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3364-121-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3376-889-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3376-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3376-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3376-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3376-887-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3376-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3692-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3692-359-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3692-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3692-368-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3692-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4120-7-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4120-310-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4120-87-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4120-1-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4120-0-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4120-357-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4120-8-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4304-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4304-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4304-132-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4304-126-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4304-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4472-454-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4472-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4472-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4472-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4844-101-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4844-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4844-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4844-405-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4844-407-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4844-107-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5116-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5116-51-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5116-281-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5116-57-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5380-61-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5380-307-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5380-63-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5380-69-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/5544-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5544-78-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/5544-83-0x00000000006D0000-0x0000000000737000-memory.dmp

Download

memory/5544-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download