0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Size 6.9MB
Sample260809-mdrd7awbqd
SHA256 0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8
MD5 973d2ddbef376dc49f8175cd352fa134
SHA1 b792bef103791c4f7265cfaa64166052be3118ef
SHA512 c4d84c49497efcefbb08ca0f4e9ab64d6f37b72e1cc3909def7cfd81d5620b740b1e244d6561a2fdb4d586c3879920378e437fbf178303331a0da83fa806a423
SSDEEP 98304:rqJbc5xtz+kl/m5lif3c/PKkuExnaZ/l+7Y1rtJKCg8RVhb:eJk+y/mnifcKkbaZ/l+7Y1rtECg8bh
TLSH
T11176AE1576E840E8E073523189569A5FDEB5B9261B3642CF368C5B1F1F336D28E3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
5184	elevation_service.exe
5208	geek64.exe
2872	elevation_service.exe
4112	maintenanceservice.exe
3616	OSE.EXE
1876	PerceptionSimulationService.exe
4192	perfhost.exe
1496	ReFsDedupSvc.exe
5628	SensorDataService.exe
3344	ssh-agent.exe
5604	AgentService.exe
5388	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
5132	verclsid.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\msdtc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\vssvc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\vds.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\wbengine.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\AgentService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\dllhost.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2eebc933b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1355008678\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3828_1227625382\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1813958539\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1536700106\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1840580557\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1840580557\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\128.png	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3828_1632311524\_locales\en_US\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5408	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf4d14e2e827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000000ad81fe927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000685abb1fe927dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d74de5e1e827dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000425937e2e827dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c0a169e4e827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000050798e2e827dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307445031472444"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{6520906F-AED5-4540-A79F-FB535C22E653}	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
5184	elevation_service.exe
5184	elevation_service.exe
5184	elevation_service.exe
5184	elevation_service.exe
5184	elevation_service.exe
5184	elevation_service.exe
5184	elevation_service.exe
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeAssignPrimaryTokenPrivilege	5604	AgentService.exe
Token: 33	5388	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5388	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5388	SearchIndexer.exe
Token: SeBackupPrivilege	1496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1496	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
Token: SeDebugPrivilege	5184	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3828	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
5208	geek64.exe
5208	geek64.exe
5208	geek64.exe
5208	geek64.exe
5208	geek64.exe
5208	geek64.exe
5208	geek64.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 5208	3364	0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe	90
PID 5388 wrote to memory of 3760	5388	SearchIndexer.exe	101
PID 5388 wrote to memory of 4720	5388	SearchIndexer.exe	102
PID 5208 wrote to memory of 3828	5208	geek64.exe	103
PID 3828 wrote to memory of 464	3828	msedge.exe	104
PID 3828 wrote to memory of 4300	3828	msedge.exe	105
PID 3828 wrote to memory of 5408	3828	msedge.exe	106
PID 3828 wrote to memory of 4300	3828	msedge.exe	105
PID 3828 wrote to memory of 4300	3828	msedge.exe	105
PID 3828 wrote to memory of 2728	3828	msedge.exe	107
PID 3828 wrote to memory of 2728	3828	msedge.exe	107
PID 3828 wrote to memory of 4976	3828	msedge.exe	108
PID 3828 wrote to memory of 4976	3828	msedge.exe	108
PID 3828 wrote to memory of 4592	3828	msedge.exe	109
PID 3828 wrote to memory of 4976	3828	msedge.exe	108
PID 3828 wrote to memory of 4592	3828	msedge.exe	109
PID 3828 wrote to memory of 4592	3828	msedge.exe	109
PID 3828 wrote to memory of 3212	3828	msedge.exe	111
PID 3828 wrote to memory of 364	3828	msedge.exe	110
PID 3828 wrote to memory of 3212	3828	msedge.exe	111
PID 3828 wrote to memory of 3212	3828	msedge.exe	111
PID 3828 wrote to memory of 364	3828	msedge.exe	110
PID 3828 wrote to memory of 364	3828	msedge.exe	110
PID 3828 wrote to memory of 1640	3828	msedge.exe	113
PID 3828 wrote to memory of 1640	3828	msedge.exe	113
PID 3828 wrote to memory of 5232	3828	msedge.exe	114
PID 3828 wrote to memory of 5232	3828	msedge.exe	114
PID 3828 wrote to memory of 1904	3828	msedge.exe	115
PID 3828 wrote to memory of 1904	3828	msedge.exe	115
PID 3828 wrote to memory of 3356	3828	msedge.exe	117
PID 3828 wrote to memory of 4824	3828	msedge.exe	120
PID 3828 wrote to memory of 4824	3828	msedge.exe	120
PID 3828 wrote to memory of 4340	3828	msedge.exe	121
PID 3828 wrote to memory of 4340	3828	msedge.exe	121
PID 3828 wrote to memory of 1224	3828	msedge.exe	122
PID 3828 wrote to memory of 1224	3828	msedge.exe	122
PID 3828 wrote to memory of 5204	3828	msedge.exe	123
PID 3828 wrote to memory of 5204	3828	msedge.exe	123
PID 5388 wrote to memory of 6004	5388	SearchIndexer.exe	124
PID 5388 wrote to memory of 1344	5388	SearchIndexer.exe	125
PID 3828 wrote to memory of 4976	3828	msedge.exe	131
PID 3828 wrote to memory of 1880	3828	msedge.exe	132
PID 3828 wrote to memory of 3580	3828	msedge.exe	133
PID 3828 wrote to memory of 2268	3828	msedge.exe	134
PID 3828 wrote to memory of 2268	3828	msedge.exe	134
PID 3828 wrote to memory of 2420	3828	msedge.exe	139
PID 3828 wrote to memory of 2420	3828	msedge.exe	139
PID 3828 wrote to memory of 4140	3828	msedge.exe	140
PID 3828 wrote to memory of 4140	3828	msedge.exe	140
PID 3828 wrote to memory of 2724	3828	msedge.exe	141
PID 3828 wrote to memory of 2724	3828	msedge.exe	141
PID 3828 wrote to memory of 3748	3828	msedge.exe	142
PID 3828 wrote to memory of 3660	3828	msedge.exe	143
PID 3828 wrote to memory of 3660	3828	msedge.exe	143

C:\Users\Admin\AppData\Local\Temp\0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe
"C:\Users\Admin\AppData\Local\Temp\0f0f53581c10506c7dc8ab53a88ee4b4f72b2e175c7facb705d981a0be3539b8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Users\Admin\AppData\Local\Temp\geek64.exe
  C:\Users\Admin\AppData\Local\Temp\geek64.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://geekuninstaller.com/download/?version=1.5.1.163
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc5fc2c188,0x7ffc5fc2c194,0x7ffc5fc2c1a0
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,13001690258082731561,12784397334812400401,262144 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,11387808983917127798,199831611363446717,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:11
      4⤵
      System Time Discovery
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,17530138325643919335,17372631922590163415,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,15484814593880177393,8612989913132257285,2097152 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,8408149664197633785,4118620457060616356,2097152 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,11604951076851488359,6911071910670857763,2097152 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,14734822860204873169,16852339932517670156,2097152 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,15929557243845283766,9397420983943540209,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,8647296146287549177,5314640584482393279,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,8379377192123349768,13569937164617789566,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,8697506395384869189,11584138778039972299,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,8697506395384869189,11584138778039972299,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,6879907731219763746,9604179699339887000,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,17660441796595926093,7023061449133838854,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,7123955535066082691,8202760718987629837,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,15232663281995628530,5388161647058280339,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
      4⤵
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,138761524615808876,1465551360265956239,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,17379153902533951174,6960267203936303479,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,2127463210218258719,7497458524339137755,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3546771411838803362,9050633647510797976,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1817323873532408595,16460235436027832569,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,17087079720604045385,3702474540746165019,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=880 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,7917154973874350528,14195083811405855517,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4860,i,14588671427581355093,10044330924318530092,262144 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17096083401574507387,15503905070722396068,524288 --field-trial-handle=2460,i,11721602426039082714,15867683461105442845,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
      4⤵
      PID:3660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2872

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4112

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3616

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4192

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5628

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2688 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3012

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 17c2f3358867555723cfe3ad0c682debbb28e6edbe58bef0f27ad679dcaaba0a
MD5 201bb79f1bdf80e8e43cf5a1e7ae368b
SHA1 7e89f9a552a863ed1ee1d6d4362e64321632bca2
SHA512 3d44a417c71e5461a8f4fbb5d95fec79ebb0019276e2c1c5438041df99c8f2f30532518a4363270d0fa108fd3b00ef3c333fee661a00193f3ea169388da5d423
SSDEEP 49152:Ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxn0VKKrqkbw:O3q6HjB9Vhb
TLSH
T1E3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6828695c22610a2201762fa6e282878a0d51c39afb972de0bc4dce91892cdcd2
MD5 388c7e1bcef8f1af182642ea42fdfb1e
SHA1 95fb9e05fd04a65a746cbea9eceda88eea4def39
SHA512 1d973c0ab5929f2911ba99da0a0acafda6b0fa9b7761161284f6578cc5144ce8a199c81b0218931cf904533012ef505141201057e924226352cc581b6bc6b665
SSDEEP 24576:PXYfDtczARVoMWKzL7lJ7qAwMbXJO9iu:6tceVKKrqkbw
TLSH
T12975F16963A508F9ED67823CC9B2C501EA32785543A0F7DB03E0992A1F737D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 f94eab017bdb5a5449362350dc6986ddc53b8af3e2481cf2f2de0db4b8804cfb
MD5 8d37c9c719ee41bfa868297d868a5d7c
SHA1 1d0e0d1fee3e4e2c910a00fe13d8a04bdc6f4d6f
SHA512 6e8043348a727b8caacf783eeb6f06339e304766794062fe3cd576a3acdc1741120b9a5b64ed0ef6f5c285ad2a02ff3c6b8bafdb15b3b0e8de53a09b2c075173
SSDEEP 24576:k0Le5ji0hmxWrMMVoMWKzL7lJ7qAwMbXJO9i1:kPji0A4/VKKrqkbw
TLSH
T12A95AE66F6748331D073C0B9C5D2A68EE971308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4d55051474079b5539dffd3c3fab48960738767c26b79c91193faff31c83fd7d
MD5 c13872018ac34f3439600d21aca2a97d
SHA1 5e2395a48939bebee1655e60675ce784b25340ff
SHA512 bbb6c0201035b4a7d131c8ecbdfd58f8063c2922c3ccb0f4ced5ec395f3e71d65fab6551362a6e6e15b21ddbed04739933a67aa05d8ce1aee4c331dc3a0ce81e
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuOVoMWKzL7lJ7qAwMbXJO9ie:T/ezSC6vUzPvxHjyDVKKrqkbw
TLSH
T114756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6d2e0bbebd82c7d16cc4b3372d998c2f5f604fc7c8b708100ff0420f2caed99e
MD5 d838088df1f2699932452a6d5787e6a1
SHA1 03ad7c1da7207a1b1ee7ec7700b79edbf8110a85
SHA512 d4532d2ec3dd04dbc1e25b08f7d69ca9da99112106eb0b9a26ab068bca6694778b9d8bc24766ddca18aa3cb7a1bd283e6366c5d63fb2e65af3f4912be9c193c6
SSDEEP 24576:pVbqPb88hv/l+6tVoMWKzL7lJ7qAwMbXJO9i4:pVO88hXl+wVKKrqkbw
TLSH
T13455AE66F5748331D073C0BAC4D29A9AEE3234425B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 b0bf51ba91e46c0c141acda91c9887c9e40aa066a78258e8e03a01c62a1c5ae7
MD5 aacf4c49bb9d968b4458fccc3ede6c6c
SHA1 f13b2c7f2509ef49f0ac9aae8e1e5e893f96fc90
SHA512 5fbd3d924eba7f26862dba312cbf78f912a616945c82e82facc5b32e158c181ba0b0edc5ed41cdbf0cf68e22955aea74995553a3d9cb14cec8aa833a9858489c
SSDEEP 12288:8gYV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisp:8gYVoMWKzL7lJ7qAwMbXJO9iE
TLSH
T13D5523DB43170891E37695387AFAC10434282C9950A075A3A3B0F96E6CFDBE1E5BC567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 bd882650674ebb4a5001eff4726e2ee81d43555a00106e953d0d723e3a5c55c1
MD5 de8d0adacccd2b418146cad549ed6eb5
SHA1 fe9e33817e624b1b4c079ee59208e1080352edcc
SHA512 b7b29f43972fa541e7e8c77674c8f26f732d1f8559d4be927d8e206d20832e7c99c969f479123cd429ee2ec054b10db90fcf8cae5ce9e24a41dea03bbd875f47
SSDEEP 12288:9eBNUbTVO86UFV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zish:9JIUFVoMWKzL7lJ7qAwMbXJO9iE
TLSH
T1C075CF7BEE28FCD2C27A9D7856A1C600A77278704B61A3CBD174C20EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c0a770d1370f0f8e2c8e105ac051b82ce6a736cd37e5703196cc98d8d4357575
MD5 ee33ad4ae6bdbb2c6ce355676cc004c3
SHA1 95695341c487a874b0f0cfba8005e4d300295490
SHA512 dcbf0da4e4ce89bb5499d102d8daf9009133190f9bf71ae935ed68de1f03f2bce9ec3c803f48a246716f25edd786e2b91ed221abb484bab0217c389fe4c13808
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THq:4QvGAdlCEL8c/yRNw5C+Vhb
TLSH
T1F5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 072fa111af52c344bec592993bf4242123a2b0fafbce73d114d12085d35c0f85
MD5 1b6a22124d209066a097f67fb7d5c438
SHA1 1697323c9bd5fb22bc2c1290ab3e4ee7a210e435
SHA512 ab326ffb4c9cecdceb3f73e419edaa0d7cd3f422576be25dc56dee1f9de6ea481a583dad586306a822cf1795b95872b60669548b0758b1e47917cd9afc17674d
SSDEEP 12288:JAwSfxL/2Dc3EDLLmt0LDQewsAjvV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMsw:6ZewsAjvVoMWKzL7lJ7qAwMbXJO9ix
TLSH
T17875E031FA75E436C37B0DB62B36C706143C79204B612AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 82866cb26cdf4081378fd189e387e095ad3186dbeba1ae3df69893604dacedf1
MD5 e6a736c3fb0476c0f27eb7e951a3f11c
SHA1 7461847de9c0b70b689c489e7a53b4074163d9fd
SHA512 b3319df5d7993890a9b6babdc1dd29abd896c0e4bd580655ff70a4aa2e93c1d0567105027591242bccc6f8274e23dea56ee299ca930f09f6eb41482dfcbe389c
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHFh:3UEtQevvqc2W1cpV2EI32F
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7ca62ce35e25a18c22852fb117910dc4f47476674c63d9d9d5a81e0c40f7ed68
MD5 31eed091723c91a18d262becff1dedb3
SHA1 c20eae53ff381e47de232336c1413f5aa30c8a49
SHA512 1a4644c3b8dad386c666d784242ee5cd1d5c32519a5a39ed22f444dd3d80df27e0b7fa1f57f3347dc93f5779fb68aba03a84701df0a874e6403c604d2a2303b8
SSDEEP 49152:rCbRquA/m2yL5zLfFiV+XenmE3/zPVKKrqkbw:0oq2VjnmSVhb
TLSH
T10ED58D0976B881E4D1F6C77896A2C647F37178154B30ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 258fe604e1d1df7f41fbb3df61d32e695a0f4afb1dd31ce5698cf4ee5158354b
MD5 60a5fb26422cbc83825db96172343105
SHA1 8e2d1137f0464a2e0a5cf28c513aaad512b28106
SHA512 2dadee4d537acd391e3a2b0989aa4f7400d39fcaac77e2ec71c890e4ecfeb3ad6abed75dbac038f1a6cfb8ff2819360085e22a4c709818d1cdb623468873b08f
SSDEEP 24576:BAhGLJIFoiwtA5l7S53yVoMWKzL7lJ7qAwMbXJO9ij:BAMyFoiq5CVKKrqkbw
TLSH
T13835AE81E7F955D4F5B3AA7899B68170EA76BCA65E30D20F2160D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b58430f67aa8256d88894fad239aae49120e68281f5f9b14da8158f1e47a314b
MD5 0d3bc7a83efc2747985ad19a15355347
SHA1 b028b49eaba6fe9410041426d1c0b80729005a62
SHA512 9f68e1702b9beedd477d83b465241445abbe3e2cbecd9562fca9ee909a3ab41f7f0d484c1dfd819670b023f9211f28ae316b98d3eeda050a929410b217212e16
SSDEEP 12288:7mw5HEjsChNpBFgl0WDm+CuV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpe:awuEOWjVoMWKzL7lJ7qAwMbXJO9ia
TLSH
T17875F18A73A50CF9E567823885A7C136F7B27C122A21D71F1360C65B6F77361AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 7a715c2febea2ad5e9040e7bb3037c56c835eff927edf0b024ddb2bf0d3a6f34
MD5 07ed129c0812c8b9d34451b8007b8857
SHA1 a48d8139abf97cb0d4e3b261158872ab66bcaced
SHA512 b7fd9e177cc5898752502a932cc6384cee023f8643e81de01cac523c4bed55eda6b099857b6680b9228854a10396ae3ea782566042e89fe96cbcd827f03f968c
SSDEEP 12288:amZ1IyfV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zis/:TZukVoMWKzL7lJ7qAwMbXJO9i2
TLSH
T1D06512DA23A520F5E2B3923CD9F68204A7713866237153CF1360966A2FB7BD15D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ec90b6318f5cb47ccc69c5bed4bf8b3a846c3882c969c0fd6b83e8ce0c860189
MD5 a1b98d335699fd9fb2fa42944fa0cfd1
SHA1 b18ec7bb95cb43d362d44f6500093665622d0111
SHA512 5bf1b7f9a73e7ac99a1ae5ac98dad00b945d799d10b785182b9e04c3c94916a38ee2ee564783441b512633aa1fa06687b7be18a2ae0945bce8a76a3854be5bcf
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:YQRQyi36YOcPQLvw2gAf+PN3JVhb
TLSH
T1EF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 859a1c8165e40600e1273735a578a16ea1847a86e5fbcf0c62d085aff1892a73
MD5 118970b574232b44d071677aacd84d9e
SHA1 235b72bbbd919bffdd97a4324ab583de7b2164ae
SHA512 78132e6c856daeb79e3f7eb87d4fa17187b96b02f12be8eddefefd4d432483c0ea0205676b821c2423907bf48d67e58992b3797a37afa7a4f7cf79facc13de7e
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:EQRQyi36YOcPQLvw2gAf+PN3JVhb
TLSH
T1D1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 76e523d9568499bdb9b9d1575035be489787605912a33773f35214b88a5f7729
MD5 49bd382f61aba8a3725a08f6531fe402
SHA1 a7fc7a70f76493e4de19a2a3262b7d19cfcd8f1d
SHA512 51397b8dd2c15fd56b625ea920ed54ff597543b61b8af00bd2669894644ac239d421c394e3df889a9fffb906a17cdfed6aa4143028e439946bbc84079e37b436
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00VoMWKzL7lJ7qAG:t68Qg55nhheWu7PNU3//VKKrqkbw
TLSH
T17EB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5ee34e6d81e3f33e32ac8e9a406b777ca25b73bb13df06b3f53540699af4dba9
MD5 34d85dc530f571de80f2712c8c073555
SHA1 b994dcc8e674ffac4be2e8fa99bed713714d4268
SHA512 6b8a1e415b14f4210a3fc0968c7fa318a92ffeff4589b6c56485976fae90374632e33afced03637b67946821685244767c2ae103a7c7a16f45b0a772105a71e3
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:my5112gYy5azzVvL69nLKnhZYVhb
TLSH
T179167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fc6bd7f3d6756428f5d240e93f37176ea84a33eb58af4351e3360c63640a7ed0
MD5 8d4cf2633f4c3abc232669c029b279d9
SHA1 e0ea60b2e1af02f0df8790bbdcd57255c5f16d63
SHA512 9197d8fe1aa2e6bab2a747c814f478269a105cc300713638a877028ab8cabeeb1b5efef4d48125fbbd2bb1eb1943dad73f94ca10a886e451ff504ad1611dc05d
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glhVKKrqkbw:/u6JmVxd2dhVhb
TLSH
T1C0D59D13F1DA01E8D06AD578974A9233F962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5786c4550735443277d367e8583a2ce593cb1545e3bb1611aa378a1508a7bf96
MD5 bfd1d1207a0e1955ee6648cce50fa2f4
SHA1 c8a5f5cc9b671eaeff1b2fb697b671171735c3bf
SHA512 47b07c9f0c075ac35f20ac6a738d1f6d882fc8147a17e858e35e018953576e093c1466fe562489a59d6ee5e6b2a47271bf48fab20a45a8bd0fe73760cb0ad6df
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xlVKKrqkbw:xmifPbRSVhb
TLSH
T1A5B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b28e7da86c1c06744a4c1dba5b8295a445218fc3ca325be927ce378ed19ca25f
MD5 4b9d7b5a6d3da0413a4098c268dde0c1
SHA1 00a3ddac6467510062c35fdc11363437a56ebda7
SHA512 99ce08a53a9e0d8bf0d9d078d7fba3719f38ffd74c198dc61ac89b01bdb3dd2b07665bfb09dbba5b09d4ddb8009815e08449b54c50a7179c519d523805e72d4a
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqkVKKrqkbw:/5dKTi61kVhb
TLSH
T108C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eeea98103e2187566bcd4343829cdab814dbc344d84f2a7273278606aaa90df7
MD5 110098305750f939f01a5970e14bf08b
SHA1 9758f85d73d8bb5d74803fade19628faa875a3af
SHA512 928eda76b4b791be721a42d1c6b2e7793574bebd852d1be0c61c664e873b9721693325d5deebff59a4cfb2554d71ec6d0142d3153d5308bf22ec247a98e4530d
SSDEEP 49152:XhtSn8EApI0figngiDn0AP5wRVKKrqkbw:GX2iyphmVhb
TLSH
T16B95BE13F2D900E8D06ED178C7568632E962BC160B34B6EF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 70b7cdf3185c9de8c336829d4db34a767625f87b25642bb040585101d326c48c
MD5 4a944209fb0faa9157c3a39328272673
SHA1 9ebd8fac919e7ca4e9d6ce59e63b82fc4b0596d7
SHA512 c885e72a3d318352881ebbf1cab64c62d48ca93e8609b0d6e943d2b072221825151665b57b6d1f0274a694804cd4193629cd363b8cc1574263301556b34aab10
SSDEEP 12288:AwV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5ziss:AwVoMWKzL7lJ7qAwMbXJO9iF
TLSH
T10A5523DF53570C95E2329578B6FAC144342C2C9A71A031E3B3B0B42A6DF9BF125BC9A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 838bcdae4c955000c9e8bb60d78aed680d6cc238f4eaa0c2e918b19b845baacf
MD5 d74cf9edc8be4b844ad97f4bda7e795a
SHA1 b7cc1e1dbd99c8c291ba8768234d05fae6cf1fd1
SHA512 abd98da9af74c30e2198d638dd4da173edf8a45ba206f878f80c82c40596996afe1ea022c94f155c075bc36f110e427aa4322b16391544f0f3b8703150b09c4b
SSDEEP 24576:Wfwvkk9RX6wkyAI4VoMWKzL7lJ7qAwMbXJO9i/:eMnYI4VKKrqkbw
TLSH
T18285D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF1299536E0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 08c9c553c432bdd2071c9307e9149477130507b078d4c466b5520db9cd1ca7b1
MD5 f25396fd56e86eff04fc0c23949c5b4b
SHA1 a1262c35fbd751da514709e27faa40815fb7bb95
SHA512 5ad709bcfc24f806e1cce7fdc1cf4d8889f5d518860afcdc35d15c968443d83b8f1a8bca03b993bde1339088c23c0c23f5ad8b41d7272e2831dd05ffa2723bcf
SSDEEP 49152:zYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xVKKrqkbw:3ySzPpVhb
TLSH
T1B8066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e0eb308240912bd4d1fd9dae7bd77e23e74f27a9e25b0b9f5f9577bcf715c633
MD5 0b6c057a474f4555cc614b659e75fd63
SHA1 7b357b4cbc980af769d9727c0d21f4d31877df3f
SHA512 af582af049073fa6dee94f9bfe68456c1dd89dcb62e76763dce39b780cef6135801375d209c4af7faba3636ec983c45dfa5de56db932a40b5c7d69ba8b651621
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYbVoMWKzL7lJ7qAwMbXJO9iZ:s47JUQj1irIhCnDHUPfF/hVKKrqkbw
TLSH
T1E865AE1EA3EC01E5E1BAD27885158A1AEA71742E1B31CACF1270837D6F63ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5836c2fa8d7626ad0e44c27d4c00217673a7c72575c99549ff26a464d22705ec
MD5 dca698551ba83d63312e3016d56106c0
SHA1 c1e0c053daef4a59a2145686b67eb872ba5fb391
SHA512 a30d25e7e05cfeb41caebb081a339b1e9245060e52cc3d366c7f1bcd6be3c0127fc46ae5cb68a9baf02182f847f6f327da5ce64744b2fbec1aad75acb050e2c4
SSDEEP 12288:kxsfkV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisL:ZkVoMWKzL7lJ7qAwMbXJO9i6
TLSH
T1F965F05AD29801E8C06EA279C7668640B3373C6593E0E3CB63D0F53E1FB66D05DE9A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5aa66cc8fa1b854237d2452649bc3cb9c3467a1b6cdb0bac00a998b739920bb9
MD5 f984f735c81d5159a99140697886f34d
SHA1 48fc902ab82335b81df29b535c183be630babce1
SHA512 4883a9e2ee0944690668888783278bff8178562316de7c58e59cf428ddfea426fb57dd08a8a03ce14cf24ab05566c53f3804e6a0fc4c6ce0332e6c3e7e90e84c
SSDEEP 12288:yFjzGK1U3fcDUvFSeHhb+pbvuRk6ZMBQ5W8W+iimZ:yFnGSUPc4tSWkoMBQ5/W+3K
TLSH
T1D5352841762AD75FC6A940321E33D2CCA7707D41EE05AB0773C9873FC576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 321KB
SHA256 e58e8bcb7012f3e778610df7664ef6367683c578fb262e881f5420cf2cb2edea
MD5 467c52fa176d792634b12ecaa1e12680
SHA1 93bcf8ab8e7b0f1a98c8f9a59fd7bc1c4cbd47b8
SHA512 65ac725eade5d30997e1d3f6179c210a989822b9f4e2386869317b668552cb206d33b3a76bde452dd6d495eb97b7b2586a749697ae7118db995b5d22ed105708
SSDEEP 768:cTZ/TxnlToOlTPBlTz2+EQMqZUZ/ThnlToOlTPBlTz2+EQMzbNMzeEnlToOlTPBi:oIq6Mzp1JGzXSEbw
TLSH
T146647211B764F229C4B681764C60D69BAA3DF423DF1243073FC91E99DCF3287263AA95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 56d649d75f3505798279986a918f910e36edcf3f176302e91959878e875d8df4
MD5 1a3f03165d91710682793cba09d23844
SHA1 26dc4017b9e6d9fba5b07d46d43b0446b2845a80
SHA512 6bd2714b93c3941aba61d41e6dece84ef14597c94be823157976268d0760ebb2cf8e5344ea8c5f0c698ff669b5ec76ed5c66c4b173fe39bf864b2444fbcd7656
TLSH
T156514C9443A59B82FBA545B74CD2D89A36F1CA86CD0F7A1C82507D30E446FF8E7E109B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d5f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d5f4.TMP
Size 2KB
SHA256 1f7b0c5c8a7d8ea79dd7a8bf3fb8faefa9f602be87c7a9c2ce8f8b11e7bce3c5
MD5 92c00473f2085244751eb7f70c3edf58
SHA1 9f9f0daa9e7693ebd202fb8a40740c045fa75693
SHA512 cb0ba46c761adf789c8537b193312f0c294401e8020541a7d877d384c467b6a8e9768450f75f118f1b175a13c243d19d9b0595fb990cea56e312b4b8d871c9ab
TLSH
T18C512A9483A58BC1FBA185B35CE2D89961F0CA95CD0F7A1C86503D30E806FF8E3E009B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 eac7e1c1335b42c45df376797990c3680496f45977a7bd8456b3c07eefbd0dec
MD5 15d34b1490e3e1af072f5ae784368715
SHA1 58d69855e67c693adc8f368763bfa19248867fed
SHA512 7f853b70467ede8be8f65965b22dc884170c2b73c648344d768f4adbcb97dee1eee38ef1b6ca4efa04cdbfe6793d7267622d8b8061c2c3b9e8c0d15ecc6cb842
SSDEEP 48:YALlNnO4EJ4sR4uP4SVPaCCAsLQzsdzEsucfoKsnNbBs1CKsFRvJsbFzschPOsSI:DVOBJT7LPaZzXzbANbeaRMPhEiwQ
TLSH
T14181CCF3C2E9866D992196F0AB146F1BDE2D1914432C3D5EC5E8AE5F93E2870D21078F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c5ba031dcba748b6102283b6b0f34f7ce060d60b411177948f1c19cb0ae4873a
MD5 bf2f81e9f344077eab28841deafc1536
SHA1 f38443466068bec0c926d0d6ec011b65cb0f5ba4
SHA512 ab93ffdf57231e4eb0692cd4e393a06bf9c4d7eca41dc02383bf160b5d319245c3c9483cf64aaa818899081acdef9c748180eb5ec7c4e19fff27035961eefaeb
SSDEEP 192:sxRe+RtCd/fosXcHFSa8zoA8pQD/g6+WNwBu/SN5tRbBOiZ6/GWIgVVJ:sxRNmd/fosXclSate/5D/C6nN
TLSH
T17842C856A928A93B5CC7D21DFE16BF53D6F91032A1911F58B7FC9A1C04E7ADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1d8ce2d12359a8010072912e105abe72b0f772ff64db79d4208704936f1f66da
MD5 dc1cd10244605be455e104613ed71c3e
SHA1 3f541737910308de94ac33669d21eaa2f833d3bb
SHA512 199e5eaa81aa2183f91206d2663e8e605756d94c5ccf202536c4fe230e6bd730d32af82b612f621572366312d370977dabb22cf0f35ba3b5ae75b65863dff174
SSDEEP 192:sxReRRtCd/foswl6ZVzoA8pQD/g6+WNwBu/SN5tRb9O4x6/GWIgDClVpJ:sxRqmd/foswls4e/5D/C6nm
TLSH
T18142C8166924A93B5CCBD21DFA56BF63D2F91032A1911F48B7FC9A1C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9fec5af60886fb44ad944bb79e600c644d79cdc8da2cc855770359d2bed8557d
MD5 43f395eefda0afe3652c8317086535ac
SHA1 c7aafa97105f4581be38e23c6faee2580ffac23c
SHA512 5407714e31889195be987393995276e5f78404317df1a3e87e584e335a6388b571d274453c8d4eaa6b626f2c89c9db622ab91e637658bcf40f9261fdab4e303f
SSDEEP 192:sxReRRtCd/foswc6ZVzoA8pQD/g6+WNwBu/SN5tRbBOix6/GWIgDwlVpJ:sxRqmd/foswcs4e/5D/I6n8
TLSH
T12C42C816A924A93B5CCBD21DFA56BF63D2F91032A1D11E48F7FC9A1C04E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 45ca9febf04e684606b6f2cae96156e4e8a2b8ce14e873e65cfabbc3758c3f5d
MD5 8b98bfafda35dc6f1b3b4036ef1c369c
SHA1 251c053f46da5fb507ae2717713f1125a53b151e
SHA512 58cfafa182b22bdfd54ed0c0b62da3d549a7ecd382db46467848cfb74f82e5dd7e4dced81bb6b7f08c5a26faf219959f55cd83b233d633bb243202ac9dee0803
SSDEEP 768:Fb1poD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVGJ8IwroSSJ:Fb1po1E7otWgikfq4u1ja9yIbt
TLSH
T155C2DA3B640CCA7F5F804ADDEC197E9B6DA802CB96D8CD8047FE951C02C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 416f5207ed3758b9520b61d4915b45e31866499635b01a0e0f1b646bf026e1ea
MD5 410465a35732204ccad18f6cd0b165dd
SHA1 f797db10896323b0fa058272209606f59a4a5d9c
SHA512 9d5cb6417ace396d53a169cfbeab4d4e1932db1edf5d040fcfab014b13a737ba0f1812566e90e40697ec485b8705b6c6a76cbd7e8f48912a0da61d79594eca65
SSDEEP 96:KRU1gkeCGEWCPvgsEK4hgklQUuSW0Wyf/gc0K4xgW0cUUfO0pHzc5t7xxNWlqgga:CU1gkeCG7CPYs4hgklQUuSWLyfocIxg0
TLSH
T1C1914611713A43C0383EA60C81799C2F9282B492341DE5ABB7AB05664F6BF439DFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5eac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5eac.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 96ba5c857fd3a6beca51fa48422373c2b6ba2b8fce28507f7335bcd6ad0b88e0
MD5 c09ab7efffe2dbb2c73026e54dff7aeb
SHA1 4112bb65aedd34988cfb3ff065c4c8524606b756
SHA512 353183acbda973193cefca1608d3252aca1e7872fc7a35a5d2049e613c31b4e897eb8fa53a510ed563c9398b1a09d87d457d86a680dcd1e9373bce3a153437d0
SSDEEP 768:EFV33qwg6YUu4vHUtZu4aWADIidy8LuSCmU7RRxBni:M335UtZzaNsuVLRCm8RRzi
TLSH
T165037C79EC95DA7BA9F69780F3467A06DDF051B3C8C999E4D9DC4E4E00871AD0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 a01df2e8c9e4f12bb46749bbb2bfc86724d7d8a263d05c44159a85b2f10744e4
MD5 d52288bb5cd77d1a49b53a2a98013c47
SHA1 5540584091af9c3bce777bf389a8a6d7347dcb58
SHA512 4703a9a62b50a168e6dca40b4fbd6cf67925ee94aa2ef29860a8985457d9ed0ab44c829206d9d0617e2a85f3013d7fa62c6bee59f1ca3df72be30428d4b1c1f7
SSDEEP 768:ps3XYUdBqobGHftZu4aWADIidy8LuSCmU7RRxBni:ps3eftZzaNsuVLRCm8RRzi
TLSH
T16AF2AE78EC56DEB794AAA280F2873A06EDF49173D8C94AE4D9DC4B0E00875BD0357C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 665c58878d70bccced5a6e1105860d91d1d82aea36b5cf5931c72f1027bfc365
MD5 5f2c70229839e34543666e24e9ac664b
SHA1 57098bc884105cad6f93f4a02f77b51d180a415a
SHA512 afd5e9a7556462c13eee875151b18b5655ed0e4b29471094e0942e0e10500cddc37a17f31481e86ba3b695cbe86a5f726f44539b110458cda07c93ebf0ae604a
SSDEEP 768:9rv+4UNbdC3qCOBqobGHmpZu4aWADIidy8Lq6eVH1S1C:9bsbw3bmpZzaNsuVLFEH1d
TLSH
T1D203BF36E85ACA779CF79284B18776077EF8926386890BE088DD1B4F41DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8e4934ee971da17e4ddb8cf883d734d74ae81a041f27636875fa7cda1534bc8b
MD5 570b61334184b568da96683ff834a7b8
SHA1 289873a253b95e3146e15d9ff4aa2c60960f69ed
SHA512 93e0b5d6b74ee3941ecde830cd043d54c0ce8772935e7efe7943c898eee8c8eb735e9eed1fc6c2595554d7cb50a1991f8853a17198e30e0a43778cbe9529555c
SSDEEP 768:Nrv+4UNbdC3GWLBqobGHxtZu4aWADIidy8LbSeVH1S1C:Nbsbw3OxtZzaNsuVLWEH1d
TLSH
T15C03BF35A859DE7359F7A284F18776077EF8516389890BE0D8DD1B4E018B4AE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 fe0cebd5fb10b239ea9ebfc43c6e33c9ae31bb16d0a923f2f69d97a21d71223c
MD5 e1cdd2cf95b4f4dcaef81c9a63f31caf
SHA1 2a303574cac577f45155cf26f8569e3f6c98629d
SHA512 ab8c239709794c16b4764dcb3447fc82028d3db42ff9a0a187dcd39641c416b1cdf7b7f294d5c0442db9db2ed467829755e9148a8c9b49bd934f5a2ab9c16c93
SSDEEP 768:Fs3qYUdBqobGHftZu4aWADIidy8LuSCmU7RRxBni:Fs3LftZzaNsuVLRCm8RRzi
TLSH
T1D0F2AE78EC56DEB794BAA280F2873A06ADF49173D8C94AE4D9DC4B0E00875BD0357C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 35c849f666f3597e0c395bc72e5d938540a34409e31030ec9104d2e80d6a37dc
MD5 c9cc9ca55d59ed00a8e8da0fab3b5aef
SHA1 44133989fe901579ab4304b5fad4a6996992e627
SHA512 84fbd6a63929b290424b8c1778b738c8164e0e8f829c877e2fb9e47290559496e1ef8e69699dc4ae8f9354310f9d19b37fd163d62264739955d698167c0867e1
SSDEEP 768:krv+4UNbdP3qY+dBqobGHftZu4aWADIidy8LuSE3:kbsbR3NftZzaNsuVLRE3
TLSH
T17F03BF35F85ADE7398BAA284F1877647BEF451A388C90AE4D9DC0B4E00874BE130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

f7346763-70a9-49c7-9e98-7761d491d88e.tmp

Path C:\Users\Admin\AppData\Local\Temp\f7346763-70a9-49c7-9e98-7761d491d88e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

geek64.exe

Path C:\Users\Admin\AppData\Local\Temp\geek64.exe
Size 3.5MB
SHA256 316fbec9eca41deef9a63837dfaf4de4369ca507c5b2143cd3a805cb238e5057
MD5 2062e8118cf10d1fba19a80a885c80f0
SHA1 7e4a6fee0595832708b9cc9ee9b7d589f9c2bcc8
SHA512 684533abd11842833a0a4bab308c5a06253307dd8f0297211624eb1acd36ade78bf85a19cf2c8f0cc0cf85593732ebd612d6c32ce49eff284ebd6d7e8aa922b2
SSDEEP 49152:j4quwLl+92FitN5YrkzIsDscQIe3H17Sv2uEoGZGzuGowIKqtBP/TXOLzh2CS0u:jZ/l+7Y1rtJKCg8H
TLSH
T196F56C4A72E801E8D0B6D179C952894BDEB2B8061B2287CF395D475B1F376E18D3F362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3828_548157437\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 869175df355e0b4ae130199d9bbf268bfae6bd1ec822c5ccb5edc2e51fef850e
MD5 f99164bebc7b9efbe028bb5abb84ab55
SHA1 4d0975ae05bc9fb415f912b8ceb8049209fce4cc
SHA512 36c99ce4feb1131192bf49bdc194d975ac83a30034e63831f974933b152f636a9c15e1f39696895fa94741df92425c95f47c3c83181d86dcc2922e52c36de2ab
SSDEEP 12288:fC7sV56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zis7:esVoMWKzL7lJ7qAwMbXJO9i6
TLSH
T1BD5523EB435B0C45F276967475BEC100302D38695B60B0D3F360B56A6CF9BE06DB8A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2c6c00bda4b47e60b68034bfd61ac25d9ebdf7f5064eded517d552b43f92c62a
MD5 da61a92f2fc10a10dd344fc68220b9ee
SHA1 d40bb4af1d06ca64b2d331a7e7de0a0f896ec730
SHA512 31dd6d6a0ada87d67e29241aa02ee792ecc25724ae83c011ca2294e058ddfc32903fe3937522818704adfb56744cc6efd1e0c99abd61da55fa69dbfee8b6ebd9
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYOVoMWKzL7lJ7qAwMbXJO9iv:Cgb4mBIBhGFbVKKrqkbw
TLSH
T14565AE1E22EC02F5E0F6D2B89DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 971b7fd26002702b90b6ddb6ac4ab565c5ee22e651f3a1e08631333c775cbbe3
MD5 c915d5390d04eadb3703f64842accc41
SHA1 1e664eafdc3fd6a53d141b8bc96a2dfcff7dafbe
SHA512 3616963f6698c91837d14ec8a5623db63bde3eebd0e5ee13212c3503a686909b27f12119e373f5e47ce021c94c8f2be0f52c8f53cfc333acd2b84a3d2910d445
SSDEEP 24576:CG88u8FpJqH1Xzria7/mrVoMWKzL7lJ7qAwMbXJO9ij:Z7ZFPqVqa7/2VKKrqkbw
TLSH
T1C995F16573E101F0D47BD1388A964663F6B2B8250360FBDF07A88A551F23BE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 8b6504991f6ba899234eb6978e462dc33ac43fdb774c8f7ffe1d88ab208af463
MD5 cfaf937100696ec438255039add93a62
SHA1 712d2d57a2bacfa8d63da764c140928758ea1416
SHA512 efe6e363286e436a0fe4890c75d59c139b208518f414ea270bca802e2fb0fe28635241ae00db743531a7b8f77861f5f59e1eb8188dfde52aac17ef29e4b2818e
SSDEEP 12288:HHvUrBFrEjwaQ3V56iptWaygdhX7dtl3Rb7tgimAwyUdmQXMswDpxpFJzK5zisu:HPUr+NQ3VoMWKzL7lJ7qAwMbXJO9iT
TLSH
T1D775E16F22A91CE5E676E17C89968209F77174621311A2CF03E0817E5E77EE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 af7f9bbd6a0981582d63ba021b38970f953bfd5bbc47d8aff8fde1959c0a08b8
MD5 60f819aae40adb73658062dbf5bc54aa
SHA1 36e7925438fa194d88d686dad40baa9381502008
SHA512 b207ebe971f223c02651379ece66dafff8eb53c96685ddaa9b7762ae8b10edb64bb6abcb7f7212de709e98cd2f9a94d022c93989807d4d2711e4f315f4244500
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHVKKrqkbw:UG05lO43bgVhb
TLSH
T1AED5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033456CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e6dea6b0a0397cfc44595a90d0d9f9aa4ca01c3e27504d2b9fd79c2d9d69617a
MD5 191754f727c4234b51497b3dfa3b7167
SHA1 86145e09e51f7cf64e6e7976d9504b71caa6f1a7
SHA512 150a34ff46f51c6b825c09ff6a9597cae97fc25c9a073bce76c403957cd00fe9367261fcae16d4f75a202861a6a455bcf411e223f2015d99a2a4c13414570f83
SSDEEP 24576:Nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxVoMWKzL7lJ7qAwMbXJO9il:9a5POZ3+Jt2pasx2+m/VKKrqkbw
TLSH
T19E65AE5EA2FC01D5D1B9D17DC583861AF5B1342653319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2e2471fdd2f7852cc01e9c07bd2233893bb088e2d17c7e3fff4249df957473ba
MD5 003232b8ac61d3eba2a0992ba1b6023d
SHA1 0e0dfe381c1df868f93036095f8db7478180d0db
SHA512 4dde1a5cb734bd48e58af92dd79a25e8bb590eedb69268231c76cf57c80a729ef9c6af9689e0835de5e33f0ea4470da4c2ab00839ddd4913b4928f9561d806d3
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkDVoMWKzL7lJ7qAwMbXJO9iJ:lNc/zEOVHFWVKKrqkbw
TLSH
T147857B6623E901E4E1BBE1BE89779546FA717869133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0775a6d6e37dfb12e08ebcc517dbf9cb94cd4bc00fb35927296ae40ad86e1eaf
MD5 0709ab3e25201dbc4f628fc1b052d222
SHA1 1910b40726ac1263f6b0d86b4ec4a15d0a13e3cf
SHA512 5dbdb45fd0f0b316e0a8eb1c639c8a75b3247a8477102471692479d1873bd1d447d3097a21598613d9dc203981ed96434eda5454319fc3e22199c38bbc41ca91
SSDEEP 24576:28kNvNnaFeYhJNtmZBm1VoMWKzL7lJ7qAwMbXJO9im:28MwBtOm1VKKrqkbw
TLSH
T15755AF6EB6B806E4D1FAC6B4DD238512EA727461073293CB5390C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 f8090d9d32d3e784a180f13e9627bd4cdf1c0ee86e640e1a6d6e0f5811ba8604
MD5 8e094f84c0e3a9bc10b1b2bc818c93eb
SHA1 f689c110bba94bcb72a96b5c7107bf8c07d76e34
SHA512 9edb5d81eb315350e419b6953ebd22e88ebf42d6d5d9eed836f307947e0980e921b2bd0896103e5ef075db437b5f44136897efdabe6b94bbe90b9425fac57a20
SSDEEP 24576:ED3FHshBIYQgAQVoMWKzL7lJ7qAwMbXJO9i3:EDVHeBIAAQVKKrqkbw
TLSH
T17D85E17EE65D04E4E57BD1BCDA638606E67138A9032166DB02D081BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-109-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1496-102-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1496-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1496-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1496-840-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1496-842-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1876-79-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1876-281-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1876-72-0x0000000140000000-0x0000000140186000-memory.dmp

Download

memory/1876-83-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2872-328-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2872-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2872-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2872-334-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2872-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2872-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3344-129-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3344-362-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3344-135-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3344-127-0x0000000140000000-0x00000001401F9000-memory.dmp

Download

memory/3364-108-0x0000000000400000-0x0000000000AE4000-memory.dmp

Download

memory/3364-0-0x00000000029D0000-0x0000000002A37000-memory.dmp

Download

memory/3364-5-0x0000000000400000-0x0000000000AE4000-memory.dmp

Download

memory/3364-6-0x00000000029D0000-0x0000000002A37000-memory.dmp

Download

memory/3364-7-0x00000000029D0000-0x0000000002A37000-memory.dmp

Download

memory/3616-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3616-56-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3616-247-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/3616-63-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4112-41-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4112-54-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/4112-52-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/4112-43-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/4112-48-0x0000000001710000-0x0000000001770000-memory.dmp

Download

memory/4192-87-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/4192-91-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/4192-97-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/4192-326-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/5184-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5184-139-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5184-23-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5184-16-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5184-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5388-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5388-163-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5388-156-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5388-407-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5604-147-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5604-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5604-151-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5604-149-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5628-122-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5628-116-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5628-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5628-348-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5628-364-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5628-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download