128858097fea36d400b2cf123be577cc90819ead84cbc432515cada9efa434dc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Size 3.5MB
Sample260807-a9qfjsdc62
SHA256 128858097fea36d400b2cf123be577cc90819ead84cbc432515cada9efa434dc
MD5 381377126127a65fb1a641a34a48c7b9
SHA1 8051e535c7f6e85b8938bb03f76004939c932884
SHA512 757511506abe484db13fb6c80a8d5fbe5cc12f17d65f6bb07b9a94042e4cd012ee54a6cb32ac702ef253844849631eba15fe31f4ac5497739a04b409bb3b887d
SSDEEP 98304:8YEFJhW6cXlQTaL6PL7j4pIERxaIo2e+ywndLm:8jM6cXlQTaSL/4aERoTwndL
TLSH
T1F706BF22FF019423F9D34172A2BF5BB28C3D9724136A94DBA6D11C7899302E2773D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution ransomware spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral1/memory/4076-0-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000900000002434a-31.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/4076-48-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2240-42-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2240-244-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2240-253-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe

Executes dropped EXE 23 IoCs

pid	Process
2800	alg.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2240	mediaget-uninstaller.exe
624	elevation_service.exe
548	elevation_service.exe
2128	maintenanceservice.exe
3332	OSE.EXE
1800	fxssvc.exe
4852	msdtc.exe
4936	PerceptionSimulationService.exe
2408	perfhost.exe
4516	locator.exe
3212	SensorDataService.exe
2312	snmptrap.exe
776	spectrum.exe
1416	ssh-agent.exe
5152	TieringEngineService.exe
5224	AgentService.exe
5296	vds.exe
5336	vssvc.exe
5408	wbengine.exe
5464	WmiApSrv.exe
5596	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8418ceb68b29bb.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mediaget-uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1204	cmd.exe
4844	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2784	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed3ffd9e0726dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018dd199f0726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090a11e9f0726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7dd469f0726dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005152109f0726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000004c9e79e0726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305377162633182"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af85e29f0726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{7E6FF656-2FB3-40BE-8CD8-740F9F829F56}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4844	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2240	mediaget-uninstaller.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
2756	DiagnosticsHub.StandardCollector.Service.exe
624	elevation_service.exe
624	elevation_service.exe
624	elevation_service.exe
624	elevation_service.exe
624	elevation_service.exe
624	elevation_service.exe
624	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4076	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeDebugPrivilege	2756	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	624	elevation_service.exe
Token: SeAuditPrivilege	1800	fxssvc.exe
Token: SeRestorePrivilege	5152	TieringEngineService.exe
Token: SeManageVolumePrivilege	5152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5224	AgentService.exe
Token: SeBackupPrivilege	5336	vssvc.exe
Token: SeRestorePrivilege	5336	vssvc.exe
Token: SeAuditPrivilege	5336	vssvc.exe
Token: SeBackupPrivilege	5408	wbengine.exe
Token: SeRestorePrivilege	5408	wbengine.exe
Token: SeSecurityPrivilege	5408	wbengine.exe
Token: 33	5596	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5596	SearchIndexer.exe
Token: SeDebugPrivilege	624	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2240	4076	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	88
PID 2240 wrote to memory of 2708	2240	mediaget-uninstaller.exe	93
PID 2240 wrote to memory of 1204	2240	mediaget-uninstaller.exe	94
PID 2708 wrote to memory of 1660	2708	msedge.exe	96
PID 1204 wrote to memory of 4844	1204	cmd.exe	97
PID 2708 wrote to memory of 2784	2708	msedge.exe	98
PID 2708 wrote to memory of 3032	2708	msedge.exe	100
PID 2708 wrote to memory of 3556	2708	msedge.exe	99
PID 2708 wrote to memory of 3032	2708	msedge.exe	100
PID 2708 wrote to memory of 3556	2708	msedge.exe	99
PID 2708 wrote to memory of 3556	2708	msedge.exe	99
PID 2708 wrote to memory of 1672	2708	msedge.exe	101
PID 2708 wrote to memory of 4272	2708	msedge.exe	102
PID 2708 wrote to memory of 1672	2708	msedge.exe	101
PID 2708 wrote to memory of 1672	2708	msedge.exe	101
PID 2708 wrote to memory of 4272	2708	msedge.exe	102
PID 2708 wrote to memory of 4272	2708	msedge.exe	102
PID 2708 wrote to memory of 460	2708	msedge.exe	103
PID 2708 wrote to memory of 460	2708	msedge.exe	103
PID 2708 wrote to memory of 460	2708	msedge.exe	103
PID 2708 wrote to memory of 1252	2708	msedge.exe	104
PID 2708 wrote to memory of 1252	2708	msedge.exe	104
PID 2708 wrote to memory of 1252	2708	msedge.exe	104
PID 2708 wrote to memory of 4536	2708	msedge.exe	108
PID 2708 wrote to memory of 4536	2708	msedge.exe	108
PID 2708 wrote to memory of 924	2708	msedge.exe	109
PID 2708 wrote to memory of 924	2708	msedge.exe	109
PID 2708 wrote to memory of 1280	2708	msedge.exe	110
PID 2708 wrote to memory of 628	2708	msedge.exe	111
PID 2708 wrote to memory of 1280	2708	msedge.exe	110
PID 2708 wrote to memory of 628	2708	msedge.exe	111
PID 2708 wrote to memory of 3396	2708	msedge.exe	113
PID 2708 wrote to memory of 1416	2708	msedge.exe	114
PID 2708 wrote to memory of 1416	2708	msedge.exe	114
PID 2708 wrote to memory of 1456	2708	msedge.exe	115
PID 2708 wrote to memory of 1456	2708	msedge.exe	115
PID 2708 wrote to memory of 2300	2708	msedge.exe	116
PID 2708 wrote to memory of 2300	2708	msedge.exe	116
PID 2708 wrote to memory of 2344	2708	msedge.exe	117
PID 2708 wrote to memory of 2344	2708	msedge.exe	117
PID 2708 wrote to memory of 752	2708	msedge.exe	118
PID 2708 wrote to memory of 752	2708	msedge.exe	118
PID 2708 wrote to memory of 1968	2708	msedge.exe	119
PID 2708 wrote to memory of 1968	2708	msedge.exe	119
PID 2708 wrote to memory of 1968	2708	msedge.exe	119
PID 2708 wrote to memory of 4984	2708	msedge.exe	120
PID 2708 wrote to memory of 4984	2708	msedge.exe	120
PID 2708 wrote to memory of 4984	2708	msedge.exe	120
PID 2708 wrote to memory of 5044	2708	msedge.exe	130
PID 2708 wrote to memory of 3992	2708	msedge.exe	131
PID 2708 wrote to memory of 4068	2708	msedge.exe	132
PID 2708 wrote to memory of 4804	2708	msedge.exe	133
PID 2708 wrote to memory of 4804	2708	msedge.exe	133
PID 2708 wrote to memory of 2788	2708	msedge.exe	136
PID 2708 wrote to memory of 2788	2708	msedge.exe	136
PID 5596 wrote to memory of 5920	5596	SearchIndexer.exe	157
PID 5596 wrote to memory of 5944	5596	SearchIndexer.exe	158
PID 2708 wrote to memory of 5996	2708	msedge.exe	159
PID 2708 wrote to memory of 5996	2708	msedge.exe	159
PID 2708 wrote to memory of 5364	2708	msedge.exe	160
PID 2708 wrote to memory of 5364	2708	msedge.exe	160
PID 2708 wrote to memory of 5436	2708	msedge.exe	161
PID 2708 wrote to memory of 5720	2708	msedge.exe	162
PID 2708 wrote to memory of 5720	2708	msedge.exe	162

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe" --uninstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mediaget.com/uninstall
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff80c6cc188,0x7ff80c6cc194,0x7ff80c6cc1a0
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,205385244433995253,8777808752411387680,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:3
      4⤵
      System Time Discovery
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,7130301337294232303,16249743897293635087,262144 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,12369478793689307799,1520590098646009451,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:8
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,18349896630612625263,6237420655219933538,2097152 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,8037177272508306732,8998320801484254147,2097152 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,17785719364414570075,17878037565889814810,2097152 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,12316949913939893470,2504976083959077541,2097152 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,14735103895702173563,4130136888685164764,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,16747551908496892113,11427257282532944102,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,5961935200926065608,12495425815150453250,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15167669382512748912,4650950414309244907,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,15710197645137507276,1870832864729524448,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,15710197645137507276,1870832864729524448,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,104787952434516492,8901340646190252229,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,13266057976913231883,12021075381763506930,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,17553198562811739292,12901089177303002824,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,12211435832939213415,4667521138801677532,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,7743885605622027726,14318508612653283459,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6864,i,6722652394437699479,5843107397695465291,2097152 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6208,i,7770801398505628187,7913325887957220275,2097152 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:1
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,10623100286168112900,12183527418661905000,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15644526562800477291,4296469380276675650,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,5480114514633328971,13362062793939625103,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,7722038537663400563,17136637068250616690,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,15947154155068705356,6790645134762740221,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,6124981495268713276,5964340436059543239,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11302513239321780150,17459014521288307502,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4544,i,9717443688643761044,8414730454525646052,262144 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,13586570798677192335,4071765527683143704,524288 --field-trial-handle=2760,i,4320637472588966135,1333512268128698419,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
      4⤵
      PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4844

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:548

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2128

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3868

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4936

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4516

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3212

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5128

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5224

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5408

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5596
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5920
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 36c9b05eac8e3d3e4c1497cb057ad0cc9a72739c53e20d215d7110b7cb069106
MD5 4b334d51954d9e115e329fe30b45b18a
SHA1 3422e84d96819c5b651c2c433d470a9287948e10
SHA512 af5e844f2cb9b64220ef10831dd106b0bc86accffb9953429555e93d884adc2fd3c7721e7e77be7f0a6a42c94eff2b1948d8e8302dc186050d2ab85e54de8659
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbQ/lFTjN4:m3q6HjBfLm
TLSH
T10DD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 77f59fae523b41ae235c99c774ed08154f318920f42d5a209d29975640b9566f
MD5 3a6a3c616fc99632f23dd0ac301eec19
SHA1 eda3917153683f25245e738257b50f2e514cfef9
SHA512 ce1392935a96083a94d33952859544daa25ec1f4a992a08d497337b947a49831fe38ce94d9ba30b601d70c9907036db8b48cc44ea3062471bbfb66975370fef6
SSDEEP 12288:D1XLsswWkxy2lRq2czAYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ZXYfDtczAYnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D675F12877E448F9ED678279CCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8b3835b42a4b376711f0974d7ef49125e06ee66578e08bf199c453da59307ad5
MD5 db8b478dec4b67a9ff59da62937c6b30
SHA1 777819e5880f552bc274eb4c2a29211a88be0b26
SHA512 3f6cc646905f7fd842cb7cf865427b0b7577c02a14424a88121853c41fd15c0c4831f68c91d3ce2056c89da3f18ed5abf79558cb2b2758da800fdeb18e4a4cd7
SSDEEP 24576:A0Le5ji0hmxmrMznQ/tbw/2Mkjy6Fr7g0o:APji0AoWQ/lFTjN4
TLSH
T131959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a02a0563d7dc8a2dd1647f3ccf5ca6470a68a8e01e052bea62914bfd715accbb
MD5 aff702a9775611aef09ce890c7a6927e
SHA1 af2deb479851bb4c11e1405de4cf9370f7c765f9
SHA512 52b678851200414bb9e8b1c12daaf7ecd30b6bb34827c0806d2eb1f8797258da8621f0f0044f0b926a1bafa26ac83e3a2ca9f57d4b99555d2ef27c6bbc2ed211
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0o:Q/ezSC6vUzPvxHjyyQ/lFTjN4
TLSH
T1D2755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 65e90445157259c5c1e96e15648b2d3d848f5bdc9ed324bc0120766869c1a179
MD5 1ba3898c03a044c3ec2f707753abeb6d
SHA1 06115722069d3358cac8993dd30908fb44b2fd15
SHA512 5fb32ee9c4f5e85cd5d5620be00e6ee3e4333ce0efc41efb9a9f252a29e1c10400de453c699a7557359c8e0d412676870d52bda75ca994d51ae8f3333be5603c
SSDEEP 24576:7VbqPb88hv/l+6MnQ/tbw/2Mkjy6Fr7g0o:7VO88hXl+/Q/lFTjN4
TLSH
T18E559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 ea89c3c7c377ecfb3daec4bd598319366a92145183595e24ed8b6a1abddc2724
MD5 83bb2f267f20b07cbd25f31aa9c663ec
SHA1 430d3db5d0d3f38639ad4cecfa863fa0f6492ab7
SHA512 7a3d6a1f98d9a9894c489677a20e448f0f5931763f5ee7a173ba0522c2929fb5a72518c8764f195e7b5e9c413e3062ce792489ce6cff7d1d1414823158c991a4
SSDEEP 12288:l9HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:l9nnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DB5523696624F897FF2B06F15CC385826B7B0DC1AFD0A74E6B44322D853C39486DB785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 8d410702ab44cea266a7bf6a585aea0f9b2b5233a0a325f9997345af644fefd9
MD5 4ff8d5a2a3415caf7faf7f04315f5ee3
SHA1 b84cb941ab4604f99ef3217cb2872b37678070a8
SHA512 9c0755516dc3b233d5ca01d0da22fca2a9c05369af766fad749ec1f2200aa6b5e362dac355fc8bfc7b24140c218cc8963dc15ac4feea641fe2d57b966fc902a9
SSDEEP 12288:ReBNUbTVO86UEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:RJIUknQ/tbw/2Mkjy6Fr7g0o
TLSH
T18575CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a50a6f9a3a8065496f856e231817a191d8d11d5ed317b401fc37951378179040
MD5 34bbbc05fbbf8e86675e287bf9f8f6b2
SHA1 ac8a0d6c23287d76d841488a24bbb77fb068d3aa
SHA512 6601739c40098ad2534d73a84d1a6bda362dc2853184f9e6f3b14643a997f3de9ce5c7b9a4347b5926b49da76ba82e11ef6fa591e6c084d230756295a9f662f4
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:lQvGAdlCEL8c/yRNw5CiLm
TLSH
T149267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fe2d4e1d1c5f58ddaa5b6a6a106f0ed7411078673d515f1a995de09df4e0807f
MD5 aabef20bfab57013ce9986565029153e
SHA1 68cc1747ebad4e6fb598ab8604c17b8493fa6239
SHA512 c7491d08f727d0d204f6f910651c13be98e16d57d8055af58d69bf04fe80edcc6bb3f270a6e78fce8c525c2481950fa3d3296e34a9cc5d0492ee110f51207bfe
SSDEEP 12288:wAwSfxL/2Dc3kDLLmt0LDQewsAjGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:F5ewsAjmnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16A85E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99fd793fa9f7698aa59d1ede4f90d815eda439ae4f876c814701612fb87b2d54
MD5 d53fc01e7e3f9c79c4a8597d2e4f0906
SHA1 9cdd8d80be1195dddbfd706f887e98963c3cd9e0
SHA512 8fc4688764d76171ac7b57b61db7c48de0faee33ee14738bfef08431879fd7c9cd784d2ff969bc0081d31659fec15f4835d57477f1fe2203fb1a3d036f8fd973
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJL:DUEtQevvqc2W1cpV2EI32
TLSH
T175474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5be61bc526a995378839a05f136c07cf3fce9096646e56950191ae98e7b4d739
MD5 06ee766052fce9baae42f885de353ddb
SHA1 e0907a9316202504bf255a48f9605286514e2c30
SHA512 0b1aa7bf3a92f6090fd0be41c0ed9c3efb53613d26cd1877ce72af75a0f41b094a29d8520e65a538047afac9062a4f91163db96b6a13068c5e84101f7cef7ca6
SSDEEP 49152:uCbRquA/m2yL5zQfFiV+XenmE3/zGQ/lFTjN4:DoqtVjnmeLm
TLSH
T1B8D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8bcfbee660ea13ab3561c95f458ab94fe0241a5fea36f91d3bfec56791568a60
MD5 d6440f713daab0e47a94355e0ec1f626
SHA1 97fc535d522572a37561c246abcf9d98ea5bc362
SHA512 7258774b17e8fb23469dfc377a95c33b688a147c03d6916d8193b7104f905feac4701770370fb6998f31a3a031cafbf3c7109f608c949a8ca1ebdb98cc07b41c
SSDEEP 24576:7AhGLJIFoiwtA5l7S53JnQ/tbw/2Mkjy6Fr7g0o:7AMyFoiq55Q/lFTjN4
TLSH
T1F735AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 d63a85a8e82c7b55fc250f67a0d0768461e039aba784fbe5b87afd6274833d48
MD5 640c2d540ce1eb12f9c2ff9f385500b7
SHA1 8724a0f19d7b7b4b24ac01805e0582768b13e2ff
SHA512 6b259ab3b8f57661d73b0ad6414e471f1751507462fe50067d491288df234e4fe6bee12c982edefa8d1ae90cfb81ec17bc0b78583fc97927c9f1a334969d6291
SSDEEP 12288:4mw5HEjsChNZBFgl0WDm+CdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:1wu0OWSnQ/tbw/2Mkjy6Fr7g0o
TLSH
T16075F14A36A41CF9EA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 bb45aa8322823cef49147365ecb11b76f2fce660b211a9589850cbbb60d4d00e
MD5 d7cb19ac7945c1d4144e10034f6b05e3
SHA1 d61242da87e5a9aeddf0f5c93d3bdfa939b240cf
SHA512 d7ac5f0eeb68cf352543fd41e3e52f1b67bb9472bc0b352ef0ae3f9e2ddc2223a98cbe86c0870571805758de979aea9d24d957a1ada740ed6c89b7584c8ced22
SSDEEP 12288:Av1Z1IyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:A9ZurnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11965126933A470FAE66742B8CCE28646E7733882677193CF275442695F3B7C01E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 23efac760927f9e034c50f5b8642b207de17b6ba92cb60227e47bb7c502dbc6e
MD5 6fb3be8210aa693d62538c61c68b5ea0
SHA1 639de7e792106fa8fe11c04bf3edf216db598d7c
SHA512 e19e197756531e1350730ac020d631909f8e2a9004cd1c51d0ba7cdfc7ad2a701f7b0fc7b107e03a43bf4774b8b875e2115aef25c2ec631791df0e3351154032
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIQ/lFTjN4:eu6JmVxd2drLm
TLSH
T153D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2708_1805446308\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2708_1911008136\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2708_476583303\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2708_61427881\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 26dd1f3d0ab043de72fae51763871d83ab00be2991f140d635b1c9d6bafd6c11
MD5 8c5db2e8326b80eb6e689716e36b2f44
SHA1 947126db98c083bce94d4f10ef3ce102e691fc6c
SHA512 3e335be7f40c19bd365715d1326c12d5ce5ddb190807c27edc2173088dd69014914c583764798e142b00baf59f12df024db4eba0e0b58c7ea6074cfb29490335
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1b51c749539512080c6ad20a13972ab6d9a52384e9b6e30dee3a650066e1c61f
MD5 ad0f6c5a2c42206482d2ed700fa0746f
SHA1 787cabf476abc6dee77e02ab15865e34d9c26c75
SHA512 50104485897dce23def9fa84bcfbfc159d3f6f142f91ae864af56a2fba1ee624376e623e0c6b2b4ebb88dc44be4ffe2b002ae203db3873a56c7cecf31254bf4c
TLSH
T1D25176B43A7142C7D7481331A0D0B6D232F9A0231B07AF5236606E73EAA67E1F7F9116
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ecac4348383e8d7b0843b6971f25a47ed7ee27679665fa7c8abdb3eb71ba046a
MD5 f667b17a3fa2ef67bff647495913e669
SHA1 2dfd6a137e75d70ea66abd9cbcfe15da1bfd9f2d
SHA512 e1c28b130c077d8e331bde95141fbcc4be25259fd201c66e4cd0d649ee046eaaeeb972bb04cdeb0519fe242fc740eca12957aa1298b077cb1b764bbb561106b4
SSDEEP 192:Dvp/JaRhnJeJNgw/bqjYccAgb4AVXKPiEfnvPk9PimkQ:DvphaRhJeJNgw/bqjxcAgb4AVXKqEPvK
TLSH
T138D19BE7C7E8952FCC2197F0AB162E5ECE2E091442283C1BC9D49F1BA7E2471E24195F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 21eacc180b47e380ce50affc9b82524ebe126eb68dd72e70896773e77cb8108e
MD5 e22debebf1a4167e5b44a7f6e4b92fa1
SHA1 821fdb70b4ba152d01c6df4c9a37e3138421419b
SHA512 6288d74ab655c29797796c5a63cfe342f0537f286c98a6ac93fb2ad626c0f7aadf5549c61abf033300f0d37e4f6055aef7556107d254203155bad61d96a28504
SSDEEP 192:sxZoRAyM/jK1Ml8Miu/fJs5ggiZikfnIdpUrHW6+WND87//jAtTqVIQ94wA9PIgc:sxZoKqu/fJs5ggkikA+Hbk/BVSc
TLSH
T18262E852AA346DBB8CDBD219F954BF63D6F94462D6840D4899FCD91C00E6BEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 46658fd7e1e8001959b438a5b8566bd2d6285bd3c1f8f393d825b4490b7ff5e3
MD5 88c5cb290b9799746085d36c500199c8
SHA1 cc5b05f5ee5376d75be7aa4c1b60a03b64dfff02
SHA512 0acf41d62dd9895919337553534baa69a9512a82c1edb2b919c170ca57f343c0f7fcf383da01b0b449d5289dc8866476035a8d18a54e34bf7735d6a7b24e140d
SSDEEP 192:sxZoRAyM/jK1Ml8UQMiu/fJspgeiZikfnIdpmrHW6+WND87//jAtTqVIQ94+VFHx:sxZoKqBu/fJspgekikAcHbk/BVx75
TLSH
T1D662E992AA345DB78CEBD219F9507FA3D6F9446295840D5899FCDA1C00E7BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 76b75923481017e499374265c49f37584419841ff6640cbe70be8643f18f91d5
MD5 c7f843031ab69184338bc6c95299157f
SHA1 282ad749e2f4b7d9b616b65373a3aa107fb2e243
SHA512 86ec7ba4f07815f988c0083899912e307d2dd7a111272b965e6e1a08430e4582760a54919d6feb667fa59c9bf47d0eec933ea95c403c46ebc9de1f7d50e30b25
SSDEEP 768:MO9x8iJjp7pLuLfxNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6thALl6opd9w:7b8iJj/EfxNWvx78ru1jaDthALocdr4N
TLSH
T10EF2FA3B6C0CCB7E4F804E9CEC2A7E9A6DE8018F56D8895447FA881C03C66EE55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 39cc22087fd30430fed8d99c72966c31d914dd19817bed9fd456e4520bd1d557
MD5 f13c917b9cbeaf11ccc6e354b4d84359
SHA1 a65327b6e65af4c4ad1dc65ecafac725b7f6357b
SHA512 4ccc207b4ef19f3de4b05cf7bd16514017c316c0e924520ff3e49b88d55f77184b9d024e83aa9a9b313bbe3cc81e29c9d1b2d7ff55dee9266d4d9aab0ce47dea
SSDEEP 96:KPVZuKSYimz2Kg8LWIKHKyylUJ1vL/grjuzttgK11tXg59te3jw:GA5BL/ylUJ1vL/SjuJth1tXa9te3k
TLSH
T183C1F10672BF16032D7D251CA2A48B27478671B37058E42BBBA910B54E66E365CFCCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af31dd37-f755-4724-b3b4-93eda3062918.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\af31dd37-f755-4724-b3b4-93eda3062918.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 582364dce855c6d7bd39c977e2299bb8dd8ccd4571925815cf1fcd4bb744b9a6
MD5 1baca81f3db4d992073368f197844cfe
SHA1 075287720b8297fc6ed9e767141b822a4d4809d6
SHA512 e95e35c97c9670914bb6bb40bde74b515cfc9ee068d64f192091c4f39ea210744c93cabd8d6478266bd687a5d7d52cfa42794f27d2651729fc23f872bc9604a8
SSDEEP 192:uu1m+xasuheOwQxMGsNNaQ0Gkf7m5EQmiU1/cv4k03HHK8EFhLIhqpBf5CFh9L+N:nmZcIhsNNaXzfS2WAkOHK/FG6f5UrzC
TLSH
T126928DB06878AC3669E7E545B48633535FF89077E6C42F98D5EDA73C08862881B0B91F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9c41bb60cd1ea6c6be95686cfbfb065ed09da964372a27942d01d807044d792
MD5 7b67af91d62bc698d660171f6d81e10b
SHA1 94230ec9ec52244cb7f67ecfafa4d79ca46cbf4f
SHA512 1e0b52130d856e3d676ba89c089039d7cff36f4704c46c7faf18f2273c920a8140c44d53189679d878388fb51edbe3d44f3cca65ed05df5777ee9c7a965ffaa2
SSDEEP 96:ZqONkNQsjpfmUTmDK5ih/cIPURHl8h4otop5Y5DkBhPwivh50xy0SFYKkAxvYysw:gONR6kDfQmiUyqIZ903HHNQic5U6
TLSH
T13E02FA35AC786CBB8EE3AE06B44737275FA5113BEAD42F94DAE81B1C04D724C1306927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 84753f2167fb800ae27ac9def5680e68b033a74c3ac90f48b05361332b84f01b
MD5 4844ab828829b1ea0fd761ef519af966
SHA1 ea4d2f6f168f4f9c4ad64a100b8ab1232c240dea
SHA512 b674ed06eded99e8a7c80949c166b5a006ce34841d9f5bddf1f73c6f621c7dd22bb2c62a6b145d4bf5afd254d0e243a3f460807c559e61cf3869d9670c323110
SSDEEP 384:nQiFiZcIxzsNX8TUNTUlIlHXzfS2/A0Df4dOHK/FZ6f5UrzC:rFQBGwgVD/WC0b6SC
TLSH
T11FD2C5F198E79936E8AE5783A73E7E424EBCC063B5885984F7D85D1CCC861BFC606805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 75f55ee011d665e356c305d743477be3aa809abd932d04e340a446acfbab78fb
MD5 a76c369dc925f5cfa05ec9c156933727
SHA1 8c2c0abf77d83b33a1835572d7c977ca05e0dba8
SHA512 f21713968e599d50ac443cfbb77149e3a9522a16d36fc499cd46c76488b6a24a8d982feefc5f0c91282e7053ba3438c3addceb5ee29d7fcf0cbb757c8d208799
SSDEEP 192:uulm+xasuheOwQxMGsNNHQ0Gkf7m5EQmiU1/cv4k03HHK8EFhLIhqpBf5CFh9L+N:n2ZcIhsNNHXzfS2WAkOHK/FG6f5UrzC
TLSH
T10E929DB06878AC3669E7E545B48633535FF89077E6C41F98D5EDA73C08862881B0B91F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0a19fe169306d3cd159815423da52cfbc661cffac7dd69a6d7285d775499f034
MD5 e76082e4fd2d3976acbea95eea03bbff
SHA1 8445e8f0f25ba4ddb84f36fc7cfccc3bf302cd45
SHA512 8d0dfb23e6208ad72872083e054d7032f178668388989a6bc92874648c002584824bdd306af1f4a618a9f0fc3a55eb4249331a32dda4787b49bf8f3f5e018b33
SSDEEP 192:QON46k4QmiUy6Ig903HHK8EFScRhqpBU6:QON46B2g9OHK/F/6U6
TLSH
T10F120974A878BC7A5DE3A506F08337635FA46077DEC56F95D6E8171C04C72882B0B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

9917301b-da9d-4536-be09-9925074a2076.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9917301b-da9d-4536-be09-9925074a2076.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1f83eede9d70ed19b398716f388f0ba0b8bd05223edf502080c09f55b64d0c7a
MD5 a5d56dc0e7f166e64819c79001913749
SHA1 96b17eec566572b0882600cd1350906f6f4731b0
SHA512 52c1b3b6a7c36037cb980211fb00fe9cf0fd9bfc0e5a25005a5f6012ef359dd7188853245c5b2ec122fac286b5323ef5fb45b830d104a8d8669619a7701555dd
TLSH
T11841E958BAF91145B3B37F56ABF7A8AD847B7D772E4AD45D00010D4F4663A00C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

842b6f6c-c110-4d4c-b42b-317b93ec6930.tmp

Path C:\Users\Admin\AppData\Local\Temp\842b6f6c-c110-4d4c-b42b-317b93ec6930.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec5e1b3c-8a91-402d-b421-f6d0a3edbbd4.tmp

Path C:\Users\Admin\AppData\Local\Temp\ec5e1b3c-8a91-402d-b421-f6d0a3edbbd4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

mediaget-uninstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe
Size 3.5MB
SHA256 128858097fea36d400b2cf123be577cc90819ead84cbc432515cada9efa434dc
MD5 381377126127a65fb1a641a34a48c7b9
SHA1 8051e535c7f6e85b8938bb03f76004939c932884
SHA512 757511506abe484db13fb6c80a8d5fbe5cc12f17d65f6bb07b9a94042e4cd012ee54a6cb32ac702ef253844849631eba15fe31f4ac5497739a04b409bb3b887d
SSDEEP 98304:8YEFJhW6cXlQTaL6PL7j4pIERxaIo2e+ywndLm:8jM6cXlQTaSL/4aERoTwndL
TLSH
T1F706BF22FF019423F9D34172A2BF5BB28C3D9724136A94DBA6D11C7899302E2773D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fef36745-fdab-430e-b2ad-49ff32a5b0ed.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2708_210408069\fef36745-fdab-430e-b2ad-49ff32a5b0ed.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2708_929505695\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8418ceb68b29bb.bin

Path C:\Users\Admin\AppData\Roaming\8418ceb68b29bb.bin
Size 12KB
SHA256 31115f823c7734ab9091e667b869eff60363cb890c47c1e6b77eab4cebd2b71c
MD5 be403d0a6f78e86588d84785db8f76c2
SHA1 8dbb5962fe6c14e31bedb22b43ee529a945d13c5
SHA512 e52d5203da76212bdf7742435bd3e762478661b56538b90bf190fb1d758b75e2098b4eb92fd69f1a8fdd4c974eaab6f48c6a9405dd61b6a05279eb8845c2bc6e
SSDEEP 192:M3G7PyulOI5NuvwcQIMe3mpVXM53dHzfo3KgjRPd/zbcuxTMZsER8f8SO7lnokN5:GmgImsZpVXEdTf4Kgjhd/zvkllhD
TLSH
T1D842C00E735E5E3209CCCE5CB56B8467CF50D82E113EE141563E594B4709E62B7ED2B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 dcf9438d5cc17ac675af63fcc12079ef512ea0aa0a2d87da7d5169a47b8f1ce4
MD5 dc1d8ecc172f68a48438e1b6bfede506
SHA1 f9a536c90306f8be4a8efebbda7cfb686ee38479
SHA512 ac345613f9bc2c7a1a03cd5795abc2b500b51666a8b60cdeb4ac4c3fc62805525a800d4aa7e34657d9da6425795b70162ccc30eca713ed412fab02895579ac36
SSDEEP 12288:gMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:gMnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1855523696668F94BFA3B0AF05883C151773F1EC5AF90D38FBB482229953C3D01DAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f0785258a118f6f2cdfb43c8907005df45e1132af1e2a8bcfeea562b67cbfb17
MD5 e3470d3b08c2dd7f1b0f3eb0c848b587
SHA1 88c9640fb7ef2be7269021694578bbe7625054bd
SHA512 76827c5ffdc352bd410d5a53f176d0eb7a5868606ca3606a827fe1b345c4e1a30acb1d2c95a95ab0808356117ef56128950c802dcd1df02ef0639f7a9d2b853f
SSDEEP 49152:Oa0h2GEkuAe73q3pp46zwwQ2Q/lFTjN4:Oa0hNYG4JwOLm
TLSH
T14F859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 768a9a28d3d6ea9f384e6a0470eca1657fabd8103690eec7d4a88216caca6621
MD5 775879cf7713391f1a319544ce1467a6
SHA1 6719409a59decbd030fc31d462d94687d29034ef
SHA512 32b42300f64d446c883af369f5c834b8b38488364161353472660d493d6b8a3c0482340137fc14de42db8dfc7169d1e904171bf8d92fbc59ee4808f4cba69d97
SSDEEP 12288:thbHjfXdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:thbHjP9nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D465127D26AC20DAF63692BD89928546D7327C552B11A3DF2381423D4F3BBE40D7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b883401fadb96da8e9075a6c1dcc615180350c6ed9ef665dca181febc9f94e13
MD5 96809e63e30c248df0f79f927fc2473d
SHA1 77d10831bb4ebe561993ddf2d07552d5c610b159
SHA512 25c2b7162f885f81de3af52cb5bc71f5a823012dc17a7b594b529bffd70d7ee1696028b219beb54dadf658a9179329364647c96ed9a57ef2fa905a9ed7268773
SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/1nQ/tbw/2Mkjy6Fr7g0o:KIgnaTk46pBR/1Q/lFTjN4
TLSH
T16445BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 75fa9a4c65b61be577f31c1d44b37011882e1ab4d837da283e430ff04abc66e7
MD5 1c734fc1c8d093c12f129607333b5c6f
SHA1 b224b4354a4fe8c5d7403415471ff6adcde96792
SHA512 bd375d2443ed2aa18db27d46c253ac432841a4e3cfa9c63b568cd1068cd9af8ce092450bfaa40f4e57b846c5a4acb0e8a747f18fc952b72477e53260f777a2a4
SSDEEP 12288:kgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:kAnQ/tbw/2Mkjy6Fr7g0o
TLSH
T13F5523686518F98BFA2706F54C838542773B0EC17FA1A7CF77482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 e8216c3cd73aae2cb6acc7278e22693a066b8ecbf9d1876dc2485d02a1a2aa87
MD5 df6eddd878829486e10e04b53a76ef99
SHA1 0a6f96ab5a1a4f01a470b62225a1f657ef90fa68
SHA512 9b5510b11fc1cc16cafaf00c8b16e26a353c094748539554ed51ae0e0f39781e92cc5f7525975aa18b9e35f5dc3f5592ec0378762e03aefdcc3308a2c0b799bd
SSDEEP 12288:HObZA4LWOsvAYFT3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:otL3UTXnQ/tbw/2Mkjy6Fr7g0o
TLSH
T14C85F155F7A450F9E92B817CC8A28616E372789D1764E7DF03A84A691F333E14E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 a647655b8599660558bae6b451097ff9f2db82ad4f0b3501332ff34e38128501
MD5 a3365bbdd81e43a05fad5dccf0154513
SHA1 60b2fb888dc9780ebcc1f5f19ec6a926187f462e
SHA512 6e2c7a5e4270297352cca5d789854b676ed31f857f40455159ce1e39aa3ed49bea5c6f4cc9df743ddf9267b5a3871876d454cb28d8606476ead6375daa78e07d
SSDEEP 12288:mpFtdOLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:YO7nQ/tbw/2Mkjy6Fr7g0o
TLSH
T14165022D36EC20E6E536527D89838249E37278921B6253DF07C0817E5F77BE85C7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 332fbe1266766311a13c3b07cee3311c17d230ca4d120df00765357fd9834477
MD5 e0083e005c4b737e71f8033abc1c4357
SHA1 dbd7886802ceb111aca5c4bc49abfff1e9c33c0e
SHA512 f6f9084b7721096faae82757831826e76e0ee80d2cf1f2f45265bc04e3ec3b58bf961e3ff376aa7ac6c54d7e161626674f9b7e0e76028ac588902fff2962d337
SSDEEP 24576:Q7NM9YqZqmWMUkPjZM48Mv6bEhs8nQ/tbw/2Mkjy6Fr7g0o:Q7cBWMpPjN8DbEh9Q/lFTjN4
TLSH
T113659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 9129301bed9118d72abad61296fd430ae514095916048cfc09af47bbc0c6e610
MD5 62ce7933ff69f03f4fd36e30b3a66ad7
SHA1 18d4658db5452e215973194700e390315004862e
SHA512 645595cf601de1bf4a5bd58b7268ce790d77748be8dece502c784c3179b7cb798a643a734c14b804c169053fddab0a1779a06b2b689eb569c47777467eda2f5c
SSDEEP 24576:AW6BApg2YuyuNDYTabvcdvNYf8km1SnQ/tbw/2Mkjy6Fr7g0o:AF2YuHNETovAvNYf8kmcQ/lFTjN4
TLSH
T1AB857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 0ea6a5589a098c5e9b7d36a34a19b0679ef9bbf8c7c03dae2e3a49ab346668af
MD5 04070d23bf68d953b52bf9772b3f2f15
SHA1 193cee0f6cda35ef2db0baeeb23173992a5835dc
SHA512 2b8456b6d15164b1244583032d00efc449462a08b63ecb7c0ecb33beb720cab44e25a64fa3ab58cb67bc3c3c589073dda64413cbb61187c9514130c59e00968c
SSDEEP 24576:PAFs06+Omlf3NXEbTofnQ/tbw/2Mkjy6Fr7g0o:YFs060lVXuWQ/lFTjN4
TLSH
T1A265AF2F66AC00D5E07ED17D8997C91AF7B1746307255ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 d00b3eb74526c5805cf074a0c4ce7e2c42d093c78c781221871e37b843685979
MD5 a27619edac7cbbec3de921cbfb93867b
SHA1 584288598bc12d017243aa00f2b919c83c9d4b07
SHA512 2069917a44aae2de7bb598bf26a88a49127e6d09669c06f743f0da8598435eb06a2882b18288b76ee7ff3f721129c86e6094d6461f423e1d4f9830af9e0ab0ab
SSDEEP 12288:hCJnJ5D3VkrszxcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:4JnJ5D3WYWnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11575D03DD2A810E9E477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b288ae8c221c9af8f5506132786ec74192eeac61e3cbacdbdea3b7acbd41c79a
MD5 4ed0128fd0706147f266e22fc262cb35
SHA1 cd489d192515d445fb3395506e1bcd413b53942c
SHA512 24dcf4dce6106fcf513674ea52309f2630f6b5efb97dee612ecc0f6c21f70656c387748b23ce266fb9be935383a80facb8ec2faf988b01040639587c891f3c86
SSDEEP 24576:uEPghm6/7IIXdwcXrif7qQncjlP65i3Vu1nQ/tbw/2Mkjy6Fr7g0o:pg06DIKdwc+eQnSt65aVoQ/lFTjN4
TLSH
T1A1955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 7c607f0b1d549f6433a85962dbfa843185f049f0854ef64cc38c097723a21f97
MD5 a1c59a738a6ad44e56dcd46563f1cb10
SHA1 025e82006b0a9502beea59db66fd6af60d4d8dfe
SHA512 e2bb2267a2e93a6792baa2481629547100eea88d63a56c45a1575e6bf97e33915d5a7a5d06bfdf8c58fd4ab37f71d4f169457bfca3fc680323f7dbcda65d5049
SSDEEP 12288:fEP3RjCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:kjCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C065126D37ACB0DAE52B917D84928545D372F4A12B5267EF2680823D8F3B7E41E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4dcc64aa39d1465d9f48a2d7727f3f53a43a2d7d69d713d154cb4abb8d7682fe
MD5 021838263210990be73469c78d030f9c
SHA1 9ceb92081d1dbddb569aa50a3a64452728d55080
SHA512 ce4c141e323280698bad27ba7feb161f37a65062791d7c16e4c5f7e3a0cee1354f4169a8865b60c356a682f23ae43d5bca1d183f18c974f55e2a229084bf3285
SSDEEP 12288:GjkyNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:GIytnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18E6513186398B4C6FA7A06788DA381919B367C506F2193DF6280F33E9F3A3D46D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 9e6d2d7ae0e8828851e9ccf103de52e65adb1cdb51dba356092fd1dcc9db27d3
MD5 c5c917bb557ba3348abb4d43b3349d39
SHA1 0a3f901a9b64702abd47bbb38e9b12d265564faa
SHA512 363dbae6f5bd55cc8f51941cfe5dcddc123368c744065d4ce6dbe00aa850709811b76c0c69425d2b60ececbc6aca5b2818a439777ce86dfae4b4fae2cb291ab3
SSDEEP 12288:UWbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:tLnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15B55236C2625F88BFE2706F448928542A73A19D17F9167EF36C46239CB7D3D015BBB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c016aaaac3cf6cff5b81ce30361f793f9d49861fb83ea990a6c186bec6751937
MD5 e6e6c37b19980c7423932361c7beea3d
SHA1 54177d49372ff71253dcb5afc89a39b861295a59
SHA512 bb51ab4944fb284e3469f13fd6716c00eb1403b488791d9fc49d9829d03adb43750788f3e84f89bdb61e89d4e9977efac76358f54b09e09f6c5479732b79c8d2
SSDEEP 24576:kQ9MxZKdcz9dw3EnQ/tbw/2Mkjy6Fr7g0o:kVKZEQ/lFTjN4
TLSH
T1CD558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.5MB
SHA256 e091738ffeac3a20fda9814ab09f851227f4edcdfe3318df74e8702b3175895c
MD5 1bf459e92abe476a6d6d5c9ed9dd79d9
SHA1 eb7e337fb73361f6692fa69cee59f722167cd170
SHA512 e62a8d41f1447f813402355098f3a9221f1e627a8ae8772899e6e6e357cfaf0566b0779512ec5fe8140b3cb69a4b9fb9553b42ec9faec8a4423de2ce6cf8a3e4
SSDEEP 12288:0yoKo2FRple9pxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:0yocHApBnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FE75E01FBB6950A2E136813C89828745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 46f7f8f6f4736a118f9dc95242154b97e0dbda3c95d6a5fa09a3fd77a221f76a
MD5 95eb03d70343ebeacc82d64e030c4735
SHA1 16042b1cffc743b633eeb2c3ce95921801f3f9c0
SHA512 d6bb3c6977fda2eceb134d02d72d20a6cff68f01bc0ee5d9ec06f79413b4937a286083d33256a553a7bd1a2d3d790f61682f51275882d6592755702f01464f3b
SSDEEP 49152:wWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKBQ/lFTjN4:i0zuNI8Lm
TLSH
T109A57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f2a65cbdd3152df5ffec08be4bd81fddf636ba170a3d588a00ee420b8df3b139
MD5 6f40aa9ae3592a70307ad6ba7e9825cb
SHA1 0559fec3ea61e18332dfd874d1b125d5c9c3a81a
SHA512 d73687e16bc596f8589e27460f2ae4351b31834665975f215e471f22695d7b48a63034a03719590bb0b7a60b0638ad218d175cd8340b5e433d0137997845c326
SSDEEP 24576:01QT7EcpfxR+N5AWAz3ooiYtjMqbCnQ/tbw/2Mkjy6Fr7g0o:JTDxR+N5YzTfjMrQ/lFTjN4
TLSH
T12055B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-301-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/548-303-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/548-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/548-69-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/548-300-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/548-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/624-50-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/624-58-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/624-56-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/624-250-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/776-972-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/776-966-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/776-1063-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/776-965-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1416-1076-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1416-977-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1416-985-0x0000000140000000-0x00000001401C3000-memory.dmp

Download

memory/1416-983-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1800-914-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1800-919-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2128-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2128-80-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2128-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2128-93-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2128-101-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2240-35-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/2240-40-0x0000000002350000-0x00000000023B6000-memory.dmp

Download

memory/2240-42-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/2240-244-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/2240-253-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/2312-1059-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2312-962-0x0000000140000000-0x0000000140157000-memory.dmp

Download

memory/2408-1003-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2408-937-0x00000000005E0000-0x0000000000646000-memory.dmp

Download

memory/2408-942-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2408-943-0x00000000005E0000-0x0000000000646000-memory.dmp

Download

memory/2756-17-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2756-25-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2756-26-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2756-110-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/2800-109-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/2800-14-0x0000000140000000-0x000000014016B000-memory.dmp

Download

memory/3212-1086-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3212-950-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3212-1012-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3332-330-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3332-84-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3332-92-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3332-90-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/4076-0-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/4076-48-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/4076-8-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4076-1-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4516-1007-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4516-947-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/4852-995-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4852-918-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4936-929-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4936-932-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/4936-923-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4936-999-0x0000000140000000-0x000000014016C000-memory.dmp

Download

memory/5152-1077-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/5152-988-0x0000000140000000-0x00000001401A3000-memory.dmp

Download

memory/5224-993-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5224-991-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/5296-1119-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5296-996-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5336-1136-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5336-1000-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5408-1169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5408-1004-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5464-1186-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5464-1008-0x0000000140000000-0x0000000140187000-memory.dmp

Download

memory/5596-1013-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5596-1187-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5596-1025-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/5596-1041-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/5596-1057-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/5596-1074-0x000000000C9D0000-0x000000000C9D8000-memory.dmp

Download

memory/5944-1100-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1095-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1094-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1093-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1105-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1104-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1103-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1108-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1107-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1106-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1118-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1117-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1116-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1115-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1114-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1113-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1112-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1111-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1110-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1109-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1096-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1120-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1121-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1122-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1124-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1125-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1123-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1097-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1098-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1099-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1101-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1102-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1090-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1091-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1092-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1089-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1088-0x000001C810860000-0x000001C810870000-memory.dmp

Download

memory/5944-1087-0x000001C810860000-0x000001C810870000-memory.dmp

Download