128858097fea36d400b2cf123be577cc90819ead84cbc432515cada9efa434dc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Size 3.5MB
Sample260807-a9qfjsdc62
SHA256 128858097fea36d400b2cf123be577cc90819ead84cbc432515cada9efa434dc
MD5 381377126127a65fb1a641a34a48c7b9
SHA1 8051e535c7f6e85b8938bb03f76004939c932884
SHA512 757511506abe484db13fb6c80a8d5fbe5cc12f17d65f6bb07b9a94042e4cd012ee54a6cb32ac702ef253844849631eba15fe31f4ac5497739a04b409bb3b887d
SSDEEP 98304:8YEFJhW6cXlQTaL6PL7j4pIERxaIo2e+ywndLm:8jM6cXlQTaSL/4aERoTwndL
TLSH
T1F706BF22FF019423F9D34172A2BF5BB28C3D9724136A94DBA6D11C7899302E2773D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral2/memory/2624-0-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0005000000016b3f-29.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5296-36-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2624-44-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5296-145-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5296-342-0x0000000000400000-0x0000000000792000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 12 IoCs

pid	Process
4124	elevation_service.exe
5296	mediaget-uninstaller.exe
4476	elevation_service.exe
240	maintenanceservice.exe
2916	OSE.EXE
2004	PerceptionSimulationService.exe
2148	perfhost.exe
2536	ReFsDedupSvc.exe
5620	SensorDataService.exe
4604	ssh-agent.exe
5976	AgentService.exe
3160	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
4600	verclsid.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\44c2ed82e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\iw\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1655089410\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\128.png	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4456_1796450381\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1224439772\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1655089410\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_502500727\_locales\hi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mediaget-uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5476	cmd.exe
1976	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5600	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039ccfc700726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f24401710726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098919e720726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305377231387684"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b3c446f0726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acea026f0726dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D3377434-F80F-4DC3-A629-D934162B9B07}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1976	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
5296	mediaget-uninstaller.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
4124	elevation_service.exe
2916	OSE.EXE
2916	OSE.EXE
2916	OSE.EXE
2916	OSE.EXE
2916	OSE.EXE
2916	OSE.EXE
2916	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2624	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
Token: SeTakeOwnershipPrivilege	4124	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5976	AgentService.exe
Token: 33	3160	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3160	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3160	SearchIndexer.exe
Token: SeBackupPrivilege	2536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2536	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4124	elevation_service.exe
Token: SeDebugPrivilege	2916	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 5296	2624	2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe	90
PID 3160 wrote to memory of 1612	3160	SearchIndexer.exe	101
PID 3160 wrote to memory of 3164	3160	SearchIndexer.exe	102
PID 5296 wrote to memory of 4456	5296	mediaget-uninstaller.exe	103
PID 5296 wrote to memory of 5476	5296	mediaget-uninstaller.exe	104
PID 4456 wrote to memory of 5424	4456	msedge.exe	106
PID 5476 wrote to memory of 1976	5476	cmd.exe	107
PID 4456 wrote to memory of 3572	4456	msedge.exe	108
PID 4456 wrote to memory of 5600	4456	msedge.exe	109
PID 4456 wrote to memory of 3572	4456	msedge.exe	108
PID 4456 wrote to memory of 3572	4456	msedge.exe	108
PID 4456 wrote to memory of 4680	4456	msedge.exe	110
PID 4456 wrote to memory of 4680	4456	msedge.exe	110
PID 4456 wrote to memory of 4800	4456	msedge.exe	111
PID 4456 wrote to memory of 4800	4456	msedge.exe	111
PID 4456 wrote to memory of 4800	4456	msedge.exe	111
PID 4456 wrote to memory of 4228	4456	msedge.exe	112
PID 4456 wrote to memory of 4228	4456	msedge.exe	112
PID 4456 wrote to memory of 4228	4456	msedge.exe	112
PID 4456 wrote to memory of 1480	4456	msedge.exe	113
PID 4456 wrote to memory of 1792	4456	msedge.exe	114
PID 4456 wrote to memory of 1480	4456	msedge.exe	113
PID 4456 wrote to memory of 1480	4456	msedge.exe	113
PID 4456 wrote to memory of 1792	4456	msedge.exe	114
PID 4456 wrote to memory of 1792	4456	msedge.exe	114
PID 4456 wrote to memory of 3508	4456	msedge.exe	116
PID 4456 wrote to memory of 3508	4456	msedge.exe	116
PID 4456 wrote to memory of 2404	4456	msedge.exe	117
PID 4456 wrote to memory of 3564	4456	msedge.exe	118
PID 4456 wrote to memory of 2404	4456	msedge.exe	117
PID 4456 wrote to memory of 3564	4456	msedge.exe	118
PID 4456 wrote to memory of 3220	4456	msedge.exe	120
PID 4456 wrote to memory of 4804	4456	msedge.exe	121
PID 4456 wrote to memory of 4804	4456	msedge.exe	121
PID 4456 wrote to memory of 4804	4456	msedge.exe	121
PID 4456 wrote to memory of 4220	4456	msedge.exe	122
PID 4456 wrote to memory of 4220	4456	msedge.exe	122
PID 4456 wrote to memory of 4724	4456	msedge.exe	125
PID 4456 wrote to memory of 4724	4456	msedge.exe	125
PID 4456 wrote to memory of 1616	4456	msedge.exe	126
PID 4456 wrote to memory of 1616	4456	msedge.exe	126
PID 4456 wrote to memory of 2808	4456	msedge.exe	127
PID 4456 wrote to memory of 2808	4456	msedge.exe	127
PID 4456 wrote to memory of 2160	4456	msedge.exe	128
PID 4456 wrote to memory of 2160	4456	msedge.exe	128
PID 4456 wrote to memory of 2160	4456	msedge.exe	128
PID 4456 wrote to memory of 5620	4456	msedge.exe	129
PID 4456 wrote to memory of 5620	4456	msedge.exe	129
PID 4456 wrote to memory of 5620	4456	msedge.exe	129
PID 3160 wrote to memory of 1288	3160	SearchIndexer.exe	130
PID 3160 wrote to memory of 204	3160	SearchIndexer.exe	131
PID 4456 wrote to memory of 3216	4456	msedge.exe	135
PID 4456 wrote to memory of 5200	4456	msedge.exe	136
PID 4456 wrote to memory of 5112	4456	msedge.exe	137
PID 4456 wrote to memory of 3220	4456	msedge.exe	138
PID 4456 wrote to memory of 3220	4456	msedge.exe	138
PID 4456 wrote to memory of 4584	4456	msedge.exe	143
PID 4456 wrote to memory of 4584	4456	msedge.exe	143
PID 4456 wrote to memory of 3024	4456	msedge.exe	144
PID 4456 wrote to memory of 3024	4456	msedge.exe	144
PID 4456 wrote to memory of 3468	4456	msedge.exe	145
PID 4456 wrote to memory of 3468	4456	msedge.exe	145
PID 4456 wrote to memory of 4632	4456	msedge.exe	146
PID 4456 wrote to memory of 4632	4456	msedge.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_381377126127a65fb1a641a34a48c7b9_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_lynx_njrat_revil.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe" --uninstall
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mediaget.com/uninstall
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c0,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,15990518227513933330,11075670813433728572,262144 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,4497028214566712578,4396668387145001463,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,439041345586723483,3289476470249945608,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:13
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3360,i,711120873887943612,8624824642016173675,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3364,i,4635683435123976110,15173278952894245493,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:1
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,5228121176322603615,5044049912434287825,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,14826949893271238519,2349847509908517335,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15225237590707239970,11805317955620622505,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,5006477815991173377,4509355525250165348,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,2822287164218177110,2295648711356463022,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,2295957707482583067,2442569050134019519,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,2295957707482583067,2442569050134019519,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6276,i,13767791152043024066,18206027833015927621,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6067588702901576485,1403576789928089692,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,1313984776391134831,17089701649716002246,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,18249448961892156605,14045563228028588115,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,9650000016453445988,16273253338006858099,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6356,i,13927920172501784090,695913486736842438,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7360,i,7376528116694369852,3205685833327442997,2097152 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,1630602847353706143,17413624545815481900,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,10365413069014330630,10806709247777151973,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,2962886692844245375,18022921433070249869,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,18259806782001126665,10932829330816370984,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,12262435098086241459,14153177926176267986,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,13217471068441726419,3081017109858339975,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,16993985133158823465,16538571939705007711,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,11586851401470121150,5701704349560100857,524288 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5504,i,16910409074784206961,8290884940824360567,262144 --field-trial-handle=2172,i,7023288406602022108,6365283309643510284,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:10
      4⤵
      PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2004

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5620

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5976

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 2992 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5284

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ee814c9adb6ad9c0b33c178b402159851593f23872bb95ba3896e2e9036adad2
MD5 fc8b27b371f141c1b67e42f5e8f379eb
SHA1 b9031496c91600dc510b79ba1bbbc0075c7795f3
SHA512 4cea25fc76106a35e49dfb77ba43147a748bc4af10c25a3313f9d4bd9997e33e9a79ee012f961c6b27763bc5b9e73b3371fe4108c50ce9224cf69399ec893356
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvQ/lFTjN4:y3q6HjBLLm
TLSH
T10DD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 4472ee217ec6064da433f1411465b80cd179fadff3a350056d8ce871cf7ad92f
MD5 430f7a38b516edad61d2bbc1571dd9db
SHA1 b8e35c0fca947fa45c2a8512cdb850acfb2bb168
SHA512 d3c96c6878454a384dbbcf67b9102c9734fe76171da4519ed2a84cd370aa7b4b24403e73959e3893c18028fd95411d3be5b937d834f227fd132a400424f4dfa1
SSDEEP 12288:T1XLsswWkxy2lRq2czAeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:JXYfDtczAenQ/tbw/2Mkjy6Fr7g0o
TLSH
T15875F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 99c9cbd4abe9433f92591719d3ae42e4511cee4eed4fe83a041bb53d21527b2f
MD5 c0d44a3e2a0404379b9590d468dc0e53
SHA1 405bf9670d6ac6cb3d009d857a32132f31885c39
SHA512 16bfdf069aed5f5df0b38146a3b9f40c2625e00818f072ca4692e9e4c4a31cb9f317230df1ea9db167bb82377a167285614a2e1f9be495273729648d188115d4
SSDEEP 24576:D0Le5ji0hmxmrMVnQ/tbw/2Mkjy6Fr7g0o:DPji0AocQ/lFTjN4
TLSH
T1F0959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b36851714e819a5e92d70b0a1cadd06b6d4bbe62f996d0decd4ecebd11357ba7
MD5 a576ee1b214944aa5afd5322253ac1c5
SHA1 18a3e5b2e3b5585facbe8cbd18e0f8f405771673
SHA512 a5ea6b08ad835948c591ea63384c05e122380b3a4f24ceb880ae496441b3d3ae489529b39f361ee8f2c660d2a9d936e78b75321f8dd9070020507a1dfc079886
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyuPnQ/tbw/2Mkjy6Fr7g0o:4/ezSC6vUzPvxHjyQQ/lFTjN4
TLSH
T128755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b728e653ca5b71114c4f5ba24759b3d25c62bff8ae0cc5442223fae84b3fc77c
MD5 f8d0971745c695b2b900e9e9ef418b88
SHA1 684ecee98128dd8bdd97f2197065fba438a031f1
SHA512 3dabdcb10b854442426ca084dc7acf6a010c955c6adfb9ee82f0e5fe072c887debcfcd4ca670b2cb845ebdcce7357e406c0acb13a4a3126cd4da5bdb6feb50c2
SSDEEP 24576:ZVbqPb88hv/l+6KnQ/tbw/2Mkjy6Fr7g0o:ZVO88hXl+JQ/lFTjN4
TLSH
T183559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 ae123b0c74071410f469328a8b8438e9258309dabaa4742004ecef34ec4738a4
MD5 12af15d1ab4ba594edbcca00c72747e8
SHA1 ee1206741c01b49610d757b1b5ac8d97c6c42eab
SHA512 1693e75532a24da7abce84cb7b01056e99d00fe15f36cc76fd8d90242560c7114836c89d9343fc5959a45f31f6a8453391af390b2da606e3a5a34fe2bb8a7a12
SSDEEP 12288:o9xGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:o9BnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AB5523696624F887FB2B06F15CC38582AB7B0DC1AFD0A74E6B44322DC53C39496DB785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 569afae3197d203ce1514f3373568d0a415e259eceac3ce5f609816ccd186793
MD5 d19105e708a049520c5f7c9eaffbc984
SHA1 42e26c25d01b23b23c2eb54f0024ed4bf32139fb
SHA512 3de964ef149ec940dfab1b6d8857904deb6c00b00d8fdef270b5db6a26084801e32959aca3a2b8602544966574f988f5714a7efff07bbaca46a67294d6b997fd
SSDEEP 12288:AeBNUbTVO86UyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AJIUynQ/tbw/2Mkjy6Fr7g0o
TLSH
T14F75CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 49eb79478f8649339dc310411932d35ad62b2f2e582505636adf466ee268b6f4
MD5 23a601a9c59fbb18947c61edc7f03ac7
SHA1 d146011556360214eb7e63b02dd1c77f29181c07
SHA512 372e995db0cfbd8c143fb177ffaf7f4a02b45a8fb581697a39a1e52991ab3bdb02e1b66b028d2f496f2cae5c190a37d734790c472223d1ab1b555e05ebb50567
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:xQvGAdlCEL8c/yRNw5C0Lm
TLSH
T12A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2b23c3e12fc33d53bb649080ebc2023ac83ebafbf74efa5e34599536464ef187
MD5 a6b4387990839d37eb3307f4a0b4be82
SHA1 01739f981e412018007bbd00dd53f8d0c1abe058
SHA512 0ea9de86fafae6eac35e6bebb43ced0fc2f22fd0fdf0eae71e43b2c2472ad460e34fd463331025712580d7e982a30ff6a63e4e0ae208ca69626c0d8204001c1e
SSDEEP 12288:HAwSfxL/2Dc3kDLLmt0LDQewsAjMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:g5ewsAjMnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11E85E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 963fa3bb6296f902f6f9118a6c6cfa135ad760c13ace249f9d947cf788d053df
MD5 9b71130694d5f367b1915899453aedb3
SHA1 eae1f4397b1b39c5f0c847ee091bd3137c423d0b
SHA512 382eb9bfb2e44a8e9ed9fcbbaf9579db8549e60fc4bcf2be752466952c964644adc002b5badd6d74601a00457b3eb7cf016c5adda9737cff8c7b0d13f95cb3a3
SSDEEP 196608:QUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3L:QUEtQevvqc2W1cpV2EI32
TLSH
T19F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 77cf3029042d11f784475d938f43013051de7101372f98048329d00457e64c48
MD5 392b92542b95923633187f9b28ec9c83
SHA1 be5d447ffbd85ed737aa866a3d121c1481b8fb4d
SHA512 e6367269fa597d166e437e09bccb169e19f820073b8deeb59cddf19b2de527f04ecde997d870a5478066a7938d0ac226d48c6dda6ee9fb4d923ac7cf605f81d6
SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zsQ/lFTjN4:QoqtVjnmILm
TLSH
T164D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2d6d9d308b62dea86edd6e179b88b5c40341a9b805e5145c6597c9dd775041c1
MD5 2eae1958ec2bd3577cd5acb5088e9489
SHA1 b5d5dca944a1d4be688a621348038359561677c8
SHA512 e77cee93a19627e380b64b66e9d3aa21e8693ba2d33330f51451978a3cecf4521a13bcef3b5717ea1af659ec1140958660bbd5bdab9bb8216faa753f7196abc8
SSDEEP 24576:8AhGLJIFoiwtA5l7S53DnQ/tbw/2Mkjy6Fr7g0o:8AMyFoiq5TQ/lFTjN4
TLSH
T171359D80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 3438adcccb83e587550b20ac24cc05d48de00da8916df471307e71d00a6a0e43
MD5 575d0a421f197814834e704075846ef2
SHA1 ca8e4165aa383aaa99911d8ff6178f10c6313c36
SHA512 62f037065f735f8e5b4ab9b94bf2c1b943d1682f564a533c6ea3a0639fc3a1dfc439d908452517d002eedde0ed5195ba1f49b2a2bd07dd324e54cb1f5bd18e7b
SSDEEP 12288:1mw5HEjsChNZBFgl0WDm+CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:wwu0OWwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15675F14936A41CFAEA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ca71c52917d4904362bd587cfd11f5f35753aa974ceaac3b89b5e496fc43bcf5
MD5 91580a805c07a019858a064a8e37d6df
SHA1 37234e6828ea36fb65baca511003152870a82d82
SHA512 5db8088cf450d5011425b5b87130c65492b0ccd4aaf8073b8874e9a332f376271c43ccd5e24cb78c35bc483d25233001bbfd6a08b84a2efb06c43dadbcb55a60
SSDEEP 12288:/1Z1Iy8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:NZu9nQ/tbw/2Mkjy6Fr7g0o
TLSH
T16065126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 09b0ca9ee126b2950146317f2e2b1712d64c00e2d2d16b01a48c0315adc33420
MD5 d0244f5c69c2cd23bd244c43fd4fb24e
SHA1 a636452d9447164c4edb59f5505512c4db0cd0bb
SHA512 eae63d8b1b6c9c881ccc9c0f0a43f19e382cb5ac03cca4a2d6f245676d8668ad6ba37ef8e1ff2538649fec2b6e77e2e472c11d5560afc7f4117588835cc40e6b
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:hQRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T15D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d7e5558416b5964881c430d04becfb5683de8c4a7e91cce27f15310bb655e900
MD5 52aae51bb740f943d886844b246f1db4
SHA1 ad7fc82d02d5110a13cd8179808b828ed4e1a52a
SHA512 e2fdea0b219c9d88f5580f085bce86b22b355db59b2fd239a7c54c0bd8473544caec27be1736d49988b3dd63aec39a99c6ce0713a45893bfdf1019f72a0d187f
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0NnQ/tbw/2Mkjy6C:b68Qg55nhheWu7PNU3/cQ/lFTjN4
TLSH
T183B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a84f9c20f1747a231891688a1aed13238dfb92814718439a00ab3de0ed53d11
MD5 5cd01a2906fb71cc300122e592b3c72a
SHA1 8bd6ad8fffbba9b3e199e374bfd00141158368f3
SHA512 b79a8658393bfe4f40f7dd6503ed02d400ee8a85d5a5c1d4fb41ea5cbc633cf02e70fac461e753d1a8bf6ced239cc4cf892ee2ad551f08f3a1feeeab2db1030a
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99y:py5112gYy5azzVvL69nLKnhZmLm
TLSH
T105167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44b01d1495a4236905d0d866790eca80b349bc940e1088487ae1870c429a1738
MD5 f835369cbaa3bd9387aa377ebef64747
SHA1 1c0f404c74852ceea19d81cd1acb2f8185fbe4f5
SHA512 7910cf433544e82657e9339b832e2aa48594fac80b776074b60361d179fb26f26934f0961337e4d7d4321f9f98dd5cce951d80c3580c0ef0cf7836b42e484922
SSDEEP 49152:mB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glcQ/lFTjN4:Uu6JmVxd2d/Lm
TLSH
T1C4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 6ab62ea563774570fceb75cae253e543a6ae0c606ee054a7fb08a5346bf643b5
MD5 9fa88a146f1b52aacb5d47997a3f94ad
SHA1 f1b32d902ed253d353253486f461eb8b31f756df
SHA512 fff8180d793acec26084e4639782355d7df5f82634e92b066ebbb1346dc13b69ac90d6ff8d15c1e3c7382b5e0721d3b6b174a0aace2e4652c0c72035cfd086d2
SSDEEP 24576:AfwvZk9RX6wkyAIhnQ/tbw/2Mkjy6Fr7g0o:5MnYIhQ/lFTjN4
TLSH
T1B985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8de54f4860cfee3735e975badd9ad324bab7e905e9d6f291284391fb0fb1f4d8
MD5 b1b1d8dbf9d08c83d2fdfd1fca9e3f94
SHA1 0726aea15280e47e341e6e07c04537fc866b7230
SHA512 dabab7bf8691be105128030f9f5d00c8e65c216f0700c74b452ccdcd5e0a7330f4ee4eafcfa43e4def94c4f1ac23d0ec67099ee280ba5be5d8a0830fe17e09ef
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Q/lFTjN4:vySzPxLm
TLSH
T1F9066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e1341d587365fbdb966791c892e14318f9ea5468e842f450bb34c48b195fd42e
MD5 656201f15d52283a8f275696a3641f9b
SHA1 9ee5d5b4ffba9e0b452e1056198d0ccdbc04bf52
SHA512 d789359bdfde009226567de13a6c3601832ddc0e17f05b83965791fa6cefdb1ae5acb51db59a77453e7348c591cd1539e47b0109c56d02bfa2cfaa0efeba0489
SSDEEP 24576:b47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYnQ/tbw/2Mkjy6Fr7g0o:b47JUQj1irIhCnDHUPfF/uQ/lFTjN4
TLSH
T1CA65AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1ad4944fcde9e3db38e64b9bb34e5020692d55210c1c285a0aff0e712082e97d
MD5 9549abdb4cb34ca2788299f62e49454b
SHA1 b786686ed0a177e157a3f88b7b2392c38cac0f3a
SHA512 c8df204bd843ce6ccc0fc8b4e019047a7d75ab8fba2b7d660549176c05494ece24c008c2497b12451bf150d2a9ad37d2c2ea046006aa38a89a8b6edc7de36223
SSDEEP 12288:BRsfdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:69nQ/tbw/2Mkjy6Fr7g0o
TLSH
T10465F119D29852D9D12E52B5CB828A41B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 9c4c3de79b10832af04bfc1ad8288bee8fd2a22b5ac1696683f33eefeaeaef9c
MD5 c5cb4f15fe0753c5c72c9de27a85e585
SHA1 ff51b5134169e451b6875fd6331b8a30d60b7d11
SHA512 b0af353449ea641861d65a262e9b862b0b1bb6464cba53d0c621a43d32a8a6d9c94acdc0327512e025493e39f96137ce1f2a7b2e65214b475572059eeef77334
SSDEEP 12288:wDVDdoU3ffzeVfvi2OdfMGoBevlfJfdOGnfN1GpcLBPB/Lk:wDVDSUPfi5p7evlfVd9fN1QclPpQ
TLSH
T128452841762AD68FC6A950325E36D6CCA7707D41FE056F0373C8873FD476668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 346KB
SHA256 373e773ae234cfd5b1831e91062e76b112f3cd978a3b5c2a2a0b7b043377ae65
MD5 7b37ab0a1c28b14a46f0a3572f8a6e9d
SHA1 e03e1e82dfe00a71a500bddbdba01345d98a3e93
SHA512 502f59695ff022141c859669abe72be28d528659e8903c7070b5343d5a3761a8f124937ecadf4bd3fb8dfda7a7ed91f24c840d1be82272bf5850ad5c7888be08
SSDEEP 1536:cD+2w5RYw5Q7w5Ln0tA+yZJdw5eys2w53Jw5adw5KM:6+2kSkikj+ikZkZkqkD
TLSH
T16974A812B720B229C4B280B79870D6A7FB3CF513DF1247422BD419A9CCF72966679F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef62ad1c85af59c5c578f156eee391c882ab4db470112e0f02319e1a1ea4f322
MD5 c3133f9fdd3f3631da4af4ff77f61900
SHA1 91067809522f84489c62969409d25dfae2aa8cfd
SHA512 fb87d15a6cbaff136eb95d1bd27e012367182001e8ddeb35420ce625bfc09a2b42ae59e287dbbb01779ed634d02fa2e3e81e4fd8e99b4985dde1c4863162c609
TLSH
T1F261E87053A2C5D3CB24877757E1EA8D36F0A46B250B1E5964243C72880AF6CEDF102F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 d90bce645add383287df3d30b2488ed59536eea09d29448e1086aafe1fff67a8
MD5 d333d585c28a492e170c0240a91f7e21
SHA1 dd8f3b8c892ef081961c85c15a3ae2c9d7ec584b
SHA512 67717d2d9b5033a7d96b1af0d076ad3bbb506facf2dc1778099a62ee3a6946317b571114211afb60057a20e58498458dc7f2d6714d61fde9d031e3ddaf5df461
SSDEEP 192:DD4ddJpxe7BXJqJ5RjaVCZSoUYXvIFPfoAVR4KPSQCRfRvPw9PiSQ:DD4drpxe7B5qJ5RjaVCZSoU+vIFPfoAw
TLSH
T15EF19CE7C7E8952ECC2197F06B152E2FCE1E091442283C1BC9D49F5BA7E2471E24295F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a857f5a791008205410d47200ed3ad294f47f5c6abb644a9a69fbde1285ce9d9
MD5 8bfea642920ed9e4f0fb260704183d00
SHA1 b797bd66c8c8fd133464874e0da76fd8a6cf5ecb
SHA512 7de21fe6d417ab3147c8ab76eebeac841be04e8824d15cb049a5d7c5190826ce91eb102e0cafe713ec2174c2f9377f113cc2d2c7bdec653a6bf3d3efebc571e1
TLSH
T11621CDF3C2E8567D894181F46B183F1BCE2D0814832C3E6AC4D4AB5F93F5871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ad1503281f9fbe84c1ec5778ab9cd25cef2148e2cc5212f7f951258463585412
MD5 acf4e7489125aa673f78a94def9b6f6e
SHA1 0cc1efc42bf5987ba06b3117ca9d737d1c964a7c
SHA512 97e3e52a2b4a11304e7fbb08561f9645f05e5c3ec0fa151aa1970e5619ebe2c46d57eb00d631febec607f3cb8aa2e561874a8aa36ceae40d9bcd9a0f0dbd407e
SSDEEP 192:sxReRLCL/fRsexEjyaCZcQzMxEKzoA8pjq/g6+WNRLk/P7Id2Tt7VIYa1oLmYFGT:sxReYL/fRsJjyaE3zMGH2/5+/D3VI2u
TLSH
T19252D856A9386D3B4CD7D219FA55BF63D2FD5022A4D41E48ABFCDA1C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 79d6817898bf36bcf9a739b8204756c0768207b90852072e3236e5ae8b07940a
MD5 4fb0223937365a7bda554080e9f04cfe
SHA1 6f58f7f8e7d45106ce9972e27c31d11e3dd2dd68
SHA512 fe27e5526d29b2e0deb23bf71ac020d87b284b9685c90bb4ff9ac3128d4ddfeff0640956b978318a9049de7cc7ba5cbf35d77a9b50769e5996f18a2983873c72
SSDEEP 192:sxRJRLCL/fRsrEjy2CZcQzMxEKzoA8pjq/g6+WNRLk/P7Id2Tt7VIYa1oImYFG6d:sxRJYL/fRsQjy2E3zMGH2/5+/D3Vv2d
TLSH
T1B052D856A9286D3B4CD7D219FA55BF63D2FD5022A4D41E48ABFC9A1C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ef72b2db9529c05732966fc4f775462317d755e4ab39b533d9d81ee73a760e1a
MD5 30b14e5963c37863117063d8aac6354b
SHA1 10441faf5f479f9f720dca17bf69a2adebd1626a
SHA512 55c935699fea50f3a823e4cda6b0abb07c86f545a3c51f9d7d29ba7b20da54e3fd373f139801a3ab4afe8b77c5f7ccb0f9d18a0821d1d3a2613b08c32113eede
SSDEEP 192:sxReRLCL/fRsexEjy2CZcQzMxEKzoA8pjq/g6+WNRLk/P7Id2Tt7VIYa1oImYFGV:sxReYL/fRsJjy2E3zMGH2/5+/D3Vv2Q
TLSH
T1AA52E956B9386D3B4CD7D219FA55BF63D2FD5022A4D41E48ABFC9A1C00E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a1beded0658fabfb1ea374d9e470a38be47ac8fa2ef745d15ee8733939d36b22
MD5 47543b978e30700a5f5227e019b65beb
SHA1 2cba428f4ab514cbe51711963553d0301f328518
SHA512 94997104643d5b36469a14c3b7e62ac0e851cb3a1c684cb565eef2ab4e8d073625532433bfb023f53b0fa1cdedac0ad8c36d1073fbc6257b4b0495ad1a509c95
SSDEEP 768:j26Hky7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVosBVuw2ro9qte1:j26HkKEf6RWgs2f02u1jafsB4wNMWT
TLSH
T1C9D2EA7B640CCABF4F804ADDDC197E9F6D6802CB9698CD8447FE941C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d93c0d2a8c9432ded26f13bc371ed364deb4377da641b41927d97546144a1fd6
MD5 0f7a896b2e92b7f203e06a1b66f6e629
SHA1 c7d19281d661f239ae31e0032ff44642088589c4
SHA512 0a064dabe0fda44c18d80f1ec3a3e304312b5bd11add51b12061e1817ff71efc7190234e4348c50d29e27691da14d027266d644e078e8cb6f82bd6e1bb2c8ff8
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgzifHqKA0v:C3gFB31lERe1JDggH2vHG5FaHoZs4q2z
TLSH
T11791BF5071BE02847C3F661DC0B4991B96C274B37215652EBBE8126A4FABE124CFCDDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f8452a8-9ded-4e1e-9748-0746978a651c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1f8452a8-9ded-4e1e-9748-0746978a651c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e608df37f702e113da2865acc4714dc2ca33d4fe5f1b50c25272c3f217263180
MD5 158c802b5a2860e4292cc7768942d3e4
SHA1 b2a3f50c8119955a2c814049fe83282e1600b2c5
SHA512 b3dac127864a5999a296ea61beda1a42864a1bd4d823bff1204a3d26034543358cbfd17b3f923bbc33781fe1144e4166928ab556a39407931f0e7e39b9fadb7f
SSDEEP 768:mFoS3wwg8VxsOW8FsmKONXyer1IRCzni9TjLw7WVBuq:XS3bDdKSIqncjLw7WVBP
TLSH
T1B61339F594D39937C8AE9383673E6E429EBCD053B5889990BBD50E4DCC8617FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 92df42c007b87f9dc243d474913674c86cc91432cdd4025167333fb6f829acef
MD5 12af75efde27b914768465fd7aeccd28
SHA1 c96c2e159d72cc5f9132c3878885f185d7020ebc
SHA512 6fe680c6e7677aa091cfcde6250cb7b188c0ea29bac0c63ebc4183aae2a1c64c62d76955fa617161c1dba73b83d821bd059e086d9f0bf3b02c9facbc011bab70
SSDEEP 768:oO3rm/TBOW8FsmVONXyer1IRCzni9TjLw7WVBuq:oO3qadVSIqncjLw7WVBP
TLSH
T188F2BE74E456AD230CEAE386B5077392AFF86027D5C44A90EEEA1F4E019765E170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f3d4a8e08be5da92c9d4c5c42f0ea37d9af162511892415bd4325462cde2b361
MD5 4e52a9a4b43031a5e78716469340ee9c
SHA1 0d3489f3ba078ae6363f42ee86306d48fea9708e
SHA512 6ce0f71966d08a6fa382d081fe3ea4d29e78c379c12d55fe9df9a53d4e4f35a9f677b55b86039261483ac154259c081feaa0c1eafd77372765d8572de4ce6fa7
SSDEEP 768:hrv+4UNbdz3B9/TBOW8FxONXyer1IRCzniB+eVH1SK7:hbsbV3naxSIqnBEH1l
TLSH
T16F03BE36E4A8DE338CE2A3C5B14B72437FB86057D6840B90E9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d61a3712c157099ad614842768a082d0ee7c3a262d5f4e3e4200719f5dba00a5
MD5 a3ab24cd9b362d25290863b0a5833e1f
SHA1 9e86c1092a8afae5fd42dc8f8c9ab9cbc3d83f76
SHA512 9eba7e36258f49f2d0f9b6da336f9e2d1364d9a9ff94127564abc7246b2945828baf115fdeea06b2644f2748fc8e9f7dcb0ee723c9a05e5301561d2dcab66dba
SSDEEP 768:rO3Gm/TBOW8FsmVONXyer1IRCzni9TjLw7WVBuq:rO3zadVSIqncjLw7WVBP
TLSH
T14BF2BE74E456AD230CEAE386B5077393AFF86027D5C44A90EEEA1F4E019765E170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cc0bcc92c947da9d1399f4315c5d765ed84f21258a2b5bd22a54545d4e523b1c
MD5 11ba2a773207258904b55a8452a99ae2
SHA1 dde95fbbd607c073ca800469389c30b4182e61d7
SHA512 11886f8f1acb29734869bf2234078c1c11d0bdea5b9d24a6c642875754790f8a8b5537243515241dfa072a8fd608aaa2f0e308f467dd6ee5f0736958ad306385
SSDEEP 768:1rv+4UNbdx3Gm/TBOW8FsmVONXyer1IRCzni9Tbu:1bsbD3zadVSIqnci
TLSH
T1B003AE30E559DE334DE6A285B04B73937FB8205789C40BA4EDDA2F8E058B59E170F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

aeb88768-96e8-4212-9acb-1a4a6e4d5680.tmp

Path C:\Users\Admin\AppData\Local\Temp\aeb88768-96e8-4212-9acb-1a4a6e4d5680.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

mediaget-uninstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\mediaget-uninstaller.exe
Size 3.5MB
SHA256 128858097fea36d400b2cf123be577cc90819ead84cbc432515cada9efa434dc
MD5 381377126127a65fb1a641a34a48c7b9
SHA1 8051e535c7f6e85b8938bb03f76004939c932884
SHA512 757511506abe484db13fb6c80a8d5fbe5cc12f17d65f6bb07b9a94042e4cd012ee54a6cb32ac702ef253844849631eba15fe31f4ac5497739a04b409bb3b887d
SSDEEP 98304:8YEFJhW6cXlQTaL6PL7j4pIERxaIo2e+ywndLm:8jM6cXlQTaSL/4aERoTwndL
TLSH
T1F706BF22FF019423F9D34172A2BF5BB28C3D9724136A94DBA6D11C7899302E2773D75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1570491787\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

44c2ed82e62f061e.bin

Path C:\Users\Admin\AppData\Roaming\44c2ed82e62f061e.bin
Size 12KB
SHA256 65f7814911002c01d02ba23c982402d1e77c637b4d30cb584de3befcda76e793
MD5 53352fe4616ecc4dab5c99941401222d
SHA1 d7ed63cbd694a2d65e2acbbf8af65275009c601f
SHA512 aed5dbb3c5bb97b894e0bff485c6783838027e16a020ce5414cc415ebcfacd9342b10ff50faf7fbaf31a6f65158693f249cc839c5d25d33f3637a9333acc4169
SSDEEP 384:YghpUaaJXAtZQUgtxdP8l3IPon0pCtrznXrrpEknNVV:9IvJwZJgal3IPo4CZn71EkNn
TLSH
T13742B0A97FE43229B5250DF56AA20C146625AEB6D502713A183D1CA1EDC6FF7CCD31C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 9fa8024776ad4bfb5628a6591b5cc99ce4dcf5212164726622a6003bc05e4f9e
MD5 a151f2f711278ef2d342fef9769246e5
SHA1 d8964a5f86082a54a4bda31a2224228e6d85db88
SHA512 3ba355b0f858722accaae1fb8a0041f10f84b612041fa70f696ee89fd4fdf399e44b875d04262a70d2ffb638ae9037cbad2f330567ad73419894e2a83cec5c68
SSDEEP 12288:Ao7VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:V1nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C55522696668F94BFA3B06F048938111773F1DC5AF9093CFBB082269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ec6f54911d20a870e0c238ac15dba4d7e1bcfbe523b2c783dcf50a49c81172d6
MD5 caa7a6a95686b0009ca5692ba5864fd7
SHA1 81d5dddd531a12804c2df2e6a077162df51d85ab
SHA512 9796bc7ba85ab38b2319028932543d5faf90929ed3861ce2c0fd02fc14a3ecabea6fdf56be25dfd4b983f602317c8e6f4b42fbcd3f338e4953f8e3426592c472
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYPnQ/tbw/2Mkjy6Fr7g0o:hgb4mBIBhGFYQ/lFTjN4
TLSH
T1A165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e79697df80617d74ee82c56f5e5d04e54699659685fd2189d91cb0b4795afd4b
MD5 bdca139b66ea9b4ce46932b65a310b75
SHA1 0f7efffce8401c2be76c22683dddc7bbee734ac5
SHA512 aa035f54ad5e57c75ba76a4c536f7295c49b209bf3e0a00824da2751859abc6b8c1dd29a7ef21de2224148456c385275f742756e463f48e67044b95f196e34a0
SSDEEP 24576:5G88u8FpJqH1Hzria7/monQ/tbw/2Mkjy6Fr7g0o:s7ZFPqVaa7/nQ/lFTjN4
TLSH
T11895F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a141984f103c46ca66883d6d6f69eb4a4c06f1d687158ce955c4884b570b2514
MD5 bd886593c0c7d25bca62d2f353c674b6
SHA1 77e422712d7fd425522b957c8ea6c12197c70b43
SHA512 890c8a2c9be9e7363498709a8e196735cd7ee292decdc62ee9bac044e83c75a58d79a9355fda0918fac0c7d6db28c034fea4b8e684507900f79071c71df4a2b4
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0Q/lFTjN4:IG05lO43buLm
TLSH
T197D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c769fc24c75f0c14fdac6e5d1c5de76460714f278786676093e0f01389da9927
MD5 c282adeec49fc227adc6a8af18edb2ec
SHA1 e2dd5f494e6f236721cf2bbc7d1481f228ff4813
SHA512 c2036169404f35c73b2b49373b4b7c8b08f99c9444170d0d8ea0906be786efd39f8e65339bca497ac77d8ef4f97e41fb8901d47c10e7a62d1b8e578b0d408a50
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn+nQ/tbw/2Mkjy6Fr7g0o:fa5POZ3+Jt2pasx2+mcQ/lFTjN4
TLSH
T1FD65AE5EA6F801D5E579D17DC583860AF5B1342253329BCF122182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 554ef49da75fce8a4656044e8380ec9c4463df554f07c0f380461940e75b41fa
MD5 e181a21fc503eff34b4f2a58e229cb40
SHA1 b46cc69ffd97b0ddfcb63bd0d7383bb5f9d54ac7
SHA512 ba0aceeff4637d37f49e319076b83af3b3cfbc1c9a9c07afdaab205991ef50599199758bb21a61e5494c31a405c12453b60d4a54ba6a2c064658009e58799568
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7FkQnQ/tbw/2Mkjy6Fr7g0o:4Nc/zEOVHFHQ/lFTjN4
TLSH
T18A858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 58bae55e822aefdd8b77d7bfd02e5866ac1347524b857e202f026170707910b4
MD5 eba920a8b3370f8b3124656ad801575e
SHA1 db831dfbe09d2137b6d49254b1e5940cdd6d0cc0
SHA512 4042faedaf1b9cadb313ea4fe41eb5476e645450aab1b28d58f66936f36050c70eb08e5cbd7d7b7ec558ec8684904895d28f60bbb621f2e32eb30b0592f4cb68
SSDEEP 24576:68kNvNnaFeYhJNtmZBmQnQ/tbw/2Mkjy6Fr7g0o:68MwBtOmQQ/lFTjN4
TLSH
T12655AF2EB6B846E4D1FEC6B4CD238512E6727451173293CB5390C13E4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 aa6dc62668e994272047f5421acd365682a784a46103bfe935758f6d9817a21b
MD5 bdc3759e22fb000544f4ffb6ca48fa2c
SHA1 80557537d69e1ac26ce9ffc98619514cae09cfef
SHA512 8d1436ca086205066f1e139465490e751fffa7dee50168065a0d7744e83128406f90fba3aaf113c996def4615cb42f9ef5a6f352378c139b46766b96183640d8
SSDEEP 12288:8HvUrBFrEjwaQEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:8PUr+NQknQ/tbw/2Mkjy6Fr7g0o
TLSH
T16E75E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AD87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 22c2a98f99a420f4a66c0dec6778eca14366b63c90e6e832991b4bf5830729d1
MD5 08afa74ad1e478506b6a246e42959a34
SHA1 09688dafd02c04a30f56050789dcbdce80753525
SHA512 d6b7e6690088336b2c23ea3eb55ed7d4ab4c7034dd21b9b06f51e754d9b2068ba17c08c877660f880e9c17fd014aecf500af95e93ebc28e8840159aefa42ef84
SSDEEP 24576:UD3FHshBIYQgApnQ/tbw/2Mkjy6Fr7g0o:UDVHeBIAApQ/lFTjN4
TLSH
T1D185E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-1079-0x0000024756500000-0x00000247566CA000-memory.dmp

Download

memory/240-71-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/240-61-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/240-67-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/240-60-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/240-73-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2004-316-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2004-88-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2004-86-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/2004-94-0x0000000000B90000-0x0000000000BF0000-memory.dmp

Download

memory/2148-328-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2148-98-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2148-99-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/2148-104-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/2536-912-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2536-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2536-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2536-914-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2536-109-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2536-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2624-0-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/2624-44-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/2624-7-0x0000000002740000-0x00000000027A6000-memory.dmp

Download

memory/2624-6-0x0000000002740000-0x00000000027A6000-memory.dmp

Download

memory/2624-1-0x0000000002740000-0x00000000027A6000-memory.dmp

Download

memory/2916-76-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2916-75-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/2916-82-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2916-299-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/3160-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3160-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3160-386-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3160-171-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4124-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4124-14-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4124-22-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4124-21-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4124-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4476-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-163-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4476-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4476-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-379-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4476-381-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4604-133-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4604-339-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4604-135-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4604-141-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5296-47-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/5296-36-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/5296-45-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/5296-38-0x0000000000A30000-0x0000000000A96000-memory.dmp

Download

memory/5296-145-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/5296-342-0x0000000000400000-0x0000000000792000-memory.dmp

Download

memory/5620-335-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5620-121-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5620-122-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5620-336-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5620-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5620-128-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5976-158-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5976-154-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5976-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5976-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5976-148-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download