d0df04e819a7e15007fb1d6ce91fbbb92e17b6b348d0662c87b8e3d23d36d781

Analysis

user interaction
yes
max time kernel
488s
max time network
493s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 20:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
certifio-manager-2.2.4.exe
Size 110.4MB
Sample260821-yq2apsdb62
SHA256 d0df04e819a7e15007fb1d6ce91fbbb92e17b6b348d0662c87b8e3d23d36d781
MD5 99388870b4d89e901fbd7bb9bb9cea1d
SHA1 65f3f4adb593a53fb81bc65cb58b4c0ed51ab02b
SHA512 4d568e8c6506a3865368b5404a2644cc46573ac565d15f7af2e923af7f871f5bfcdfe55ff70ab0e259624b649eb03837f43c3c91f809886627906a2ef1e7eab1
SSDEEP 3145728:S9Len/UGQg02F6ClLX6B0PgXS+jLu0Q+9ID1NBqMG7://T02h6B0PgC+fxARN8MC
TLSH
T18148336DBFA8A6C2C424777983AB635F225DCC73E0FA5931EF36325446702F1429D826
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.4.1.311.25.2\Dll = "C:\\Program Files\\Common Files\\Entrust\\ECAW\\eeoicxf64.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.9!6\Name = "EC-BRAINPOOLP320R1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.10045.4.3.1!4\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.26!8\Name = "id-fpki-SHA1-authentication"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.5.4.97!5\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.11!6\Name = "EC-BRAINPOOLP384R1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.17!8\Name = "id-fpki-common-cardAuth"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.5.4.12!5\Flags = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.113533.7.66.3!2\Flags = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.7!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.6.2!6\Name = "id-PIV-biometricObject"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.10045.4.3.1!4\ExtraInfo = 032200000000000010000000	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.132.0.33!6\Name = "EC-P-224"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.10045.3.1.1!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.11!6\Name = "EC-BRAINPOOLP384R1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.4.2.4!1\Algid = "32783"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.132.0.10!6\Flags = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.12!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Entrust_CA_CertStore_Find_Prov\FuncName = "CertDllOpenStoreProv"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.23!8\Name = "id-fpki-SHA1-policy"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.4.1!2\Algid = "26129"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\2.5.29.14\CryptFlags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.2!6\Name = "EC-BRAINPOOLP160T1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.8!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.6.3!6\Name = "pivCardholder-Name"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.7!8\Name = "id-fpki-common-hardware"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.113533.7.74.4!7\Name = "Entrust Missing Key History Exchange"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.113533.7.65.0!6\Name = "Entrust Version Info"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.15!8\Name = "id-fpki-certpcy-mediumHW-CBP"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.21!8\Name = "id-fpki-SHA1-medium-CBP"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.113549.1.1.14!4\Algid = "32783"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.16!8\Name = "id-fpki-common-high"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.9!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.13!6\Name = "EC-BRAINPOOLP512R1"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyRevocation\DEFAULT\Dll = 43003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c0043006f006d006d006f006e002000460069006c00650073005c0045006e00740072007500730074005c0045004300410057005c0065006500630072006c007200650076002e0064006c006c00000043003a005c00570069006e0064006f00770073005c0053007900730057004f005700360034005c00630072007900700074006e00650074002e0064006c006c0000000000	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy\#1\FuncName = "CertDllVerifyCertificateChainPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.3!6\Name = "EC-BRAINPOOLP192R1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.8!6\Flags = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.132.0.9!6\Flags = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.5.4.43!5\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.8!6\Name = "EC-BRAINPOOLP256T1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.8!6\Name = "EC-BRAINPOOLP256T1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.5.4.12!5\Name = "Title"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.4.2.4!1\Algid = "32783"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.4.1.311.25.2\Dll = "C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eeoicxf.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy\#100\FuncName = "CertDllVerifyCertificateChainPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.5.4.43!5\Name = "Initials"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.5.5.7.3.8!7\Name = "Timestamping"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.132.0.30!6\Name = "EC-ANSIX9P160R2"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.5!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.6.2!6\Name = "id-PIV-biometricObject"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.132.0.10!6\Name = "EC-ANSIX9P256K1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.4!6\Name = "EC-BRAINPOOLP192T1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.22!8\Name = "id-fpki-SHA1-mediumHW-CBP"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.1!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.132.0.33!6\Name = "EC-P-224"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.6.9.1!6\Name = "piv-interim"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy\#100\FuncName = "CertDllVerifyCertificateChainPolicy"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.36.3.3.2.8.1.1.4!6\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.6.4!6\Name = "pivCardholder-DN"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Entrust_CA_CertStore_Find_Prov\Dll = "C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eecacertfind.dll"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.2.840.113533.7.66.10!2\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\2.16.840.1.101.3.2.1.3.26!8\Name = "id-fpki-SHA1-authentication"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.2.840.113533.7.65.0\FuncName = "CryptDllFormatObject"	MsiExec.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CertifiO Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Notarius\\certifio-manager\\certifio-manager.exe"	certifio-manager-2.2.4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\eesystry.exe = "C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eesystry.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\espwatchdog = "C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eecwatch.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CertifiO Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Notarius\\certifio-manager\\certifio-manager.exe"	certifio-manager-2.2.4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CertifiO Manager = "C:\\Users\\Admin\\AppData\\Roaming\\Notarius\\certifio-manager\\certifio-manager.exe"	certifio-manager-2.2.4.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
134	3940	msedge.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Entrust Certificate Agent\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eelssrv.exe	msiexec.exe
File created	C:\Windows\system32\eemdims64.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eemdissrv.exe	msiexec.exe
File created	C:\Windows\SysWOW64\eearchiv.dll	msiexec.exe
File created	C:\Windows\system32\eearchiv64.dll	msiexec.exe
File created	C:\Windows\system32\eecaroll64.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eepkcs7.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eels32.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eemdis32.dll	msiexec.exe
File created	C:\Windows\system32\eemime64.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eentwork.dll	msiexec.exe
File created	C:\Windows\system32\eepkcs764.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\eebrnd.dll	ecawin64-11.0.15.exe
File created	C:\Windows\SysWOW64\eecaroll.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eelsto.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eemime.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eepiv.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\entapi32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\eecrtmgm.dll	msiexec.exe
File created	C:\Windows\system32\eelog64.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\etfile32.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\eeenroll.dll	msiexec.exe
File created	C:\Windows\system32\eeksp.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eelog.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\enterr.dll	MsiExec.exe
File created	C:\Windows\SysWOW64\eelogsvc.exe	msiexec.exe
File created	C:\Windows\SysWOW64\eeenrollcng.dll	msiexec.exe
File created	C:\Windows\system32\eentwork64.dll	msiexec.exe
File created	C:\Windows\SysWOW64\eebrnd.dll	ecawin64-11.0.15.exe
File created	C:\Windows\SysWOW64\eeksp.dll	msiexec.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eecrlrev.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eedecrypt.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeiismsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eepdenu.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eesystry.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeiusr.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eekspmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eemdisev.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eepabmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eeselfdecryptenu.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eesfpext64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eespevents.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeefsmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eefsmsg.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeshxten64.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\logfile.xml	eelogsvc.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeccpbp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecrtmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeocsmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eepeenu.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eepeshxten64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eespomsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\logfile.xsl	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\ecautil.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eecacertfind.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeenhcsp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeenhmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eemdims.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeocsp64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eepivapp.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eepivmsg.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeccpcx64.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eecrlrev64.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeepfmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeeusr.exe	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eelsenu.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eenetmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeselfdecrypt.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eestmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeefsntf.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eeenlenu.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeenlcngmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eelsmsg.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeproxymd64.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eescenu.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeshxten.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eesfpxenu.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecacertfindmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeccpbpmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecrlmsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeenhcsp.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeiisntf.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eemdimsenu.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eep7msg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeproxymd.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeaemsg.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeccpbp.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eecertcache.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eefile.exe	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eenosntf.dll	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Entrust\ECAW\eeocsp.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eeoicxf64.dll	msiexec.exe
File created	C:\Program Files (x86)\Entrust\ECAW\1033\eestenu.dll	msiexec.exe
File created	C:\Program Files\Common Files\Entrust\ECAW\eecacertfind64.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5b78c7.mst	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\manifest.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1	msiexec.exe
File opened for modification	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eefile.exe	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\lo\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eepivapp.exe	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1275322954\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_591518340\deny_domains.list	msedge.exe
File opened for modification	C:\Windows\Installer\MSI87CB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\de\messages.json	msedge.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1\11.0.15\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\en_US\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1\11.0.15\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1\11.0.15\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1\11.0.15\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eepivapp.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eepiv.ico	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1275322954\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\~DF396987BA5F0DDB58.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eerecusr.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eeiusr.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB66C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC94B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_158712730\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\no\messages.json	msedge.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1\11.0.15\msvcp140_codecvt_ids.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eepiv.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA37.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\Installer\e5b78c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\0979278EFC8A0A6438A72320087AC3E1\11.0.15	msiexec.exe
File created	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eecerexp.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAB5.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1275322954\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1385191435\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1569814562\page_embed_script.js	msedge.exe
File opened for modification	C:\Windows\Installer\MSI8B8F.tmp	msiexec.exe
File created	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eeenlusr.exe	msiexec.exe
File created	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\eeeusr.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\epfbak.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC96B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_591518340\deny_full_domains.list	msedge.exe

Executes dropped EXE 23 IoCs

pid	Process
1388	certifio-manager.exe
4356	certifio-manager.exe
1284	java.exe
1336	java.exe
4296	ecawin64-11.0.15.exe
6212	eecwatch.exe
6244	eesystry.exe
1188	eelogsvc.exe
6324	eemdissrv.exe
6312	eelssrv.exe
6360	eelssrv.exe
6368	eelssrv.exe
6488	eemdissrv.exe
1500	uninstaller.exe
3296	certifio-manager.exe
5384	java.exe
6204	certifio-manager.exe
4696	java.exe
4112	certifio-manager.exe
7124	java.exe
2144	uninstaller.exe
4500	certifio-manager.exe
5696	java.exe

Loads dropped DLL 64 IoCs

pid	Process
1336	java.exe
1284	java.exe
1284	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
1336	java.exe
1284	java.exe
1284	java.exe
1336	java.exe
1284	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
1284	java.exe
1284	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
1336	java.exe
1284	java.exe
1336	java.exe
1336	java.exe
1336	java.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eelssrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eemdissrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certifio-manager-2.2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eesystry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eelssrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecawin64-11.0.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uninstaller.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3940	msedge.exe
7116	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	eelogsvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	eelogsvc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenFlags = "0"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenFlags = "0"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenParameters	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\Flags = "1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenStoreProvider = "EntrustCacheCertStoreProv"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenParameters	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenFlags = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenEncodingType = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenStoreProvider = "#0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\Flags = "2"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenEncodingType = "0"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenFlags = "0"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\Priority = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\Flags = "2"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenParameters	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318163992993813"	msedge.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenStoreProvider = "EntrustCacheCertStoreProv"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenParameters	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenStoreProvider = "EntrustCacheCertStoreProv"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenParameters	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\Flags = "1"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenFlags = "0"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenFlags = "0"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenParameters	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenStoreProvider = "#0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\Priority = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenStoreProvider = "#0"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenStoreProvider = "#0"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenParameters	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\Priority = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\Priority = "100"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenStoreProvider = "#0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenStoreProvider = "EntrustCacheCertStoreProv"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\Software\Microsoft	MsiExec.exe
Set value (str)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\OpenStoreProvider = "#0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenFlags = "0"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\OpenParameters	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.LocalMachine\Flags = "2"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\Flags = "2"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.Default\OpenEncodingType = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\.GroupPolicy\Priority = "0"	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal	MsiExec.exe
Key created	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates	MsiExec.exe
Set value (int)	\REGISTRY\USER\Entrust_Temp\Software\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\Priority = "100"	MsiExec.exe
Set value (data)	\REGISTRY\USER\Entrust_Temp\SOFTWARE\Microsoft\SystemCertificates\Entrust Cache\PhysicalStores\Personal\OpenParameters	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.ENT.File\shell\ = "Open,Decrypt and Verify"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.ENP.File\shell\Open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\igespcapi	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{167A8DCD-F87D-11D4-820E-00B0D055DC5E}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0979278EFC8A0A6438A72320087AC3E1\File_Security	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7M.File\shell	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7M.File\shell\Open\command\command = 560025003600650073002d0066004f0064003d005a002a0025006500210055004600260066002c00460069006c0065005f00530065006300750072006900740079003e003300470054002e003400240038004900670028004100410038006500660057003100680073004e00200031002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7C.File\DefaultIcon\ = "C:\\Windows\\Installer\\{E8729790-A8CF-46A0-837A-320280A73C1E}\\eeiusr.exe,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{167A8DB2-F87D-11D4-820E-00B0D055DC5E}\InprocServer32\ = "C:\\Windows\\System32\\eemdims64.dll"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{994D840C-936E-40E8-83B5-1BA0237E4C25}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{994D840C-936E-40E8-83B5-1BA0237E4C25}\ = "Entrust.SecureFile.Menu"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB6951DD-63BB-470f-B67E-63A5344301AC}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Entrust.PasswordProtectFile.Menu	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.enp	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\igmobilesc	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\igespscard\shell\open\command\ = "\"C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eepivapp.exe\" %1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7M.File\FriendlyTypeName = "@C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eeshlres.dll,-2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7M.File\ = "Secured File"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A34027-C332-47fa-971C-73C55762BC5C}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0979278EFC8A0A6438A72320087AC3E1\Entrust_Digital_ID_for_Users	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0979278EFC8A0A6438A72320087AC3E1\ksp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.PP7M.File\shell\Open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.EPF.File\shell\Open\command\ = "\"C:\\Windows\\SysWOW64\\eelssrv.exe\" /l \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp7m\Entrust.PP7M.File\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\igmobilesc\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Entrust.SecureFile.Menu\ = "{994D840C-936E-40E8-83B5-1BA0237E4C25}"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Entrust.PasswordProtectFile.Menu	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A34027-C332-47fa-971C-73C55762BC5C}\VersionIndependentProgID\ = "Entrust.PasswordProtectFile.Menu"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.p7m\ = "Entrust.P7M.File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pkcs7-mime	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\igespscard\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7M.File\shell\Decrypt and Verify\MUIVerb = "@C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eeshlres.dll,-5"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A34027-C332-47fa-971C-73C55762BC5C}\ProgID\ = "Entrust.PasswordProtectFile.Menu.1"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.PP7M.File\shell\Open\command\ = "\"C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eewinpd.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ent\ = "Entrust.ENT.File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.SecureFile.Menu\CurVer	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{994D840C-936E-40E8-83B5-1BA0237E4C25}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7M.File\shellex\PropertySheetHandlers\Entrust.SecuredFile.Properties\ = "{AB6951DD-63BB-470f-B67E-63A5344301AC}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\igespcapi\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.SecureFile.Menu.1\ = "Entrust.SecureFile.Menu"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00A34027-C332-47fa-971C-73C55762BC5C}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.PasswordProtectFile.Menu\CurVer	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A34027-C332-47fa-971C-73C55762BC5C}\ = "Entrust.PasswordProtectFile.Menu"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00A34027-C332-47fa-971C-73C55762BC5C}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0979278EFC8A0A6438A72320087AC3E1\msvcrt	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.ENT.File\shell\Decrypt and Verify\command\ = "\"C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eefile.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pp7m\ = "Entrust.PP7M.File"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.EPF.File\FriendlyTypeName = "@C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eeshlres.dll,-3"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{167A8DB2-F87D-11D4-820E-00B0D055DC5E}\ = "Entrust Computer Digital ID MMC Snap-in"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.enp\Entrust.ENP.File\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7C.File\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{167A8DCD-F87D-11D4-820E-00B0D055DC5E}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.ENP.File\shell\Open\command\command = 560025003600650073002d0066004f0064003d005a002a0025006500210055004600260066002c0050006100730073005f00500072006f0074006500630074003e00410038006a006b0078003d004200650052003d003500590069006c007a0073002b00460070006b002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.P7C.File\shell\Open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.EPF.File\shell\Open\MUIVerb = "@C:\\Program Files (x86)\\Common Files\\Entrust\\ECAW\\eeshlres.dll,-7"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.SecureFile.Menu\CurVer\ = "Entrust.SecureFile.Menu.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB6951DD-63BB-470f-B67E-63A5344301AC}\Programmable	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.ENT.File\shell\Decrypt and Verify\command\command = 560025003600650073002d0066004f0064003d005a002a0025006500210055004600260066002c00460069006c0065005f00530065006300750072006900740079003e003300470054002e003400240038004900670028004100410038006500660057003100680073004e002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.ENP.File\shell\Open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Entrust.EEPEG.File\shell\Import	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.eepeg	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\igespepf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\igespscard\URL Protocol	msiexec.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2952	wmic.exe
2952	wmic.exe
2952	wmic.exe
2952	wmic.exe
6108	wmic.exe
6108	wmic.exe
6108	wmic.exe
6108	wmic.exe
2100	msiexec.exe
2100	msiexec.exe
3296	msedge.exe
3296	msedge.exe
5968	msedge.exe
5968	msedge.exe
5276	msedge.exe
5276	msedge.exe
5468	wmic.exe
5468	wmic.exe
5468	wmic.exe
5468	wmic.exe
5464	wmic.exe
5464	wmic.exe
5464	wmic.exe
5464	wmic.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2952	wmic.exe
Token: SeSecurityPrivilege	2952	wmic.exe
Token: SeTakeOwnershipPrivilege	2952	wmic.exe
Token: SeLoadDriverPrivilege	2952	wmic.exe
Token: SeSystemProfilePrivilege	2952	wmic.exe
Token: SeSystemtimePrivilege	2952	wmic.exe
Token: SeProfSingleProcessPrivilege	2952	wmic.exe
Token: SeIncBasePriorityPrivilege	2952	wmic.exe
Token: SeCreatePagefilePrivilege	2952	wmic.exe
Token: SeBackupPrivilege	2952	wmic.exe
Token: SeRestorePrivilege	2952	wmic.exe
Token: SeShutdownPrivilege	2952	wmic.exe
Token: SeDebugPrivilege	2952	wmic.exe
Token: SeSystemEnvironmentPrivilege	2952	wmic.exe
Token: SeRemoteShutdownPrivilege	2952	wmic.exe
Token: SeUndockPrivilege	2952	wmic.exe
Token: SeManageVolumePrivilege	2952	wmic.exe
Token: 33	2952	wmic.exe
Token: 34	2952	wmic.exe
Token: 35	2952	wmic.exe
Token: 36	2952	wmic.exe
Token: SeIncreaseQuotaPrivilege	2952	wmic.exe
Token: SeSecurityPrivilege	2952	wmic.exe
Token: SeTakeOwnershipPrivilege	2952	wmic.exe
Token: SeLoadDriverPrivilege	2952	wmic.exe
Token: SeSystemProfilePrivilege	2952	wmic.exe
Token: SeSystemtimePrivilege	2952	wmic.exe
Token: SeProfSingleProcessPrivilege	2952	wmic.exe
Token: SeIncBasePriorityPrivilege	2952	wmic.exe
Token: SeCreatePagefilePrivilege	2952	wmic.exe
Token: SeBackupPrivilege	2952	wmic.exe
Token: SeRestorePrivilege	2952	wmic.exe
Token: SeShutdownPrivilege	2952	wmic.exe
Token: SeDebugPrivilege	2952	wmic.exe
Token: SeSystemEnvironmentPrivilege	2952	wmic.exe
Token: SeRemoteShutdownPrivilege	2952	wmic.exe
Token: SeUndockPrivilege	2952	wmic.exe
Token: SeManageVolumePrivilege	2952	wmic.exe
Token: 33	2952	wmic.exe
Token: 34	2952	wmic.exe
Token: 35	2952	wmic.exe
Token: 36	2952	wmic.exe
Token: SeSecurityPrivilege	2100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6108	wmic.exe
Token: SeSecurityPrivilege	6108	wmic.exe
Token: SeTakeOwnershipPrivilege	6108	wmic.exe
Token: SeLoadDriverPrivilege	6108	wmic.exe
Token: SeSystemProfilePrivilege	6108	wmic.exe
Token: SeSystemtimePrivilege	6108	wmic.exe
Token: SeProfSingleProcessPrivilege	6108	wmic.exe
Token: SeIncBasePriorityPrivilege	6108	wmic.exe
Token: SeCreatePagefilePrivilege	6108	wmic.exe
Token: SeBackupPrivilege	6108	wmic.exe
Token: SeRestorePrivilege	6108	wmic.exe
Token: SeShutdownPrivilege	6108	wmic.exe
Token: SeDebugPrivilege	6108	wmic.exe
Token: SeSystemEnvironmentPrivilege	6108	wmic.exe
Token: SeRemoteShutdownPrivilege	6108	wmic.exe
Token: SeUndockPrivilege	6108	wmic.exe
Token: SeManageVolumePrivilege	6108	wmic.exe
Token: 33	6108	wmic.exe
Token: 34	6108	wmic.exe
Token: 35	6108	wmic.exe
Token: 36	6108	wmic.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1336	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
1284	java.exe
1284	java.exe
1284	java.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
3416	msiexec.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
1948	MsiExec.exe
3416	msiexec.exe
5976	msedge.exe
5384	java.exe
5384	java.exe
5384	java.exe
4696	java.exe
4696	java.exe
4696	java.exe
4696	java.exe
7124	java.exe
7124	java.exe
7124	java.exe
5696	java.exe
5696	java.exe
5696	java.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
1336	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
1284	java.exe
1284	java.exe
1284	java.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
6244	eesystry.exe
5384	java.exe
5384	java.exe
5384	java.exe
4696	java.exe
4696	java.exe
4696	java.exe
4696	java.exe
7124	java.exe
7124	java.exe
7124	java.exe
5696	java.exe
5696	java.exe
5696	java.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1336	java.exe
1284	java.exe
1336	java.exe
1336	java.exe
1284	java.exe
2100	msiexec.exe
3416	msiexec.exe
5768	MsiExec.exe
1948	MsiExec.exe
6060	MsiExec.exe
2536	MsiExec.exe
6156	MsiExec.exe
6188	MsiExec.exe
6236	MsiExec.exe
6276	MsiExec.exe
6300	MsiExec.exe
6324	MsiExec.exe
6348	MsiExec.exe
6372	MsiExec.exe
6428	MsiExec.exe
6456	MsiExec.exe
6488	MsiExec.exe
6512	MsiExec.exe
6536	MsiExec.exe
6560	MsiExec.exe
6584	MsiExec.exe
6608	MsiExec.exe
6632	MsiExec.exe
6656	MsiExec.exe
6680	MsiExec.exe
6700	MsiExec.exe
6724	MsiExec.exe
6748	MsiExec.exe
6784	MsiExec.exe
6808	MsiExec.exe
6832	MsiExec.exe
6856	MsiExec.exe
6880	MsiExec.exe
6904	MsiExec.exe
6928	MsiExec.exe
6952	MsiExec.exe
6976	MsiExec.exe
7000	MsiExec.exe
7024	MsiExec.exe
7056	MsiExec.exe
7080	MsiExec.exe
7104	MsiExec.exe
7128	MsiExec.exe
7152	MsiExec.exe
6160	MsiExec.exe
6192	MsiExec.exe
6252	MsiExec.exe
6288	MsiExec.exe
6308	MsiExec.exe
6336	MsiExec.exe
6356	MsiExec.exe
6404	MsiExec.exe
6376	MsiExec.exe
6416	MsiExec.exe
6448	MsiExec.exe
6480	MsiExec.exe
6484	MsiExec.exe
6512	MsiExec.exe
6552	MsiExec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 1388	2140	certifio-manager-2.2.4.exe	89
PID 1388 wrote to memory of 3068	1388	certifio-manager.exe	91
PID 4356 wrote to memory of 3356	4356	certifio-manager.exe	94
PID 3068 wrote to memory of 1284	3068	cmd.exe	96
PID 3356 wrote to memory of 1336	3356	cmd.exe	97
PID 1336 wrote to memory of 5976	1336	java.exe	99
PID 5976 wrote to memory of 5536	5976	msedge.exe	100
PID 5976 wrote to memory of 4928	5976	msedge.exe	101
PID 5976 wrote to memory of 3940	5976	msedge.exe	103
PID 5976 wrote to memory of 4928	5976	msedge.exe	101
PID 5976 wrote to memory of 4928	5976	msedge.exe	101
PID 5976 wrote to memory of 5628	5976	msedge.exe	104
PID 5976 wrote to memory of 5628	5976	msedge.exe	104
PID 5976 wrote to memory of 2756	5976	msedge.exe	105
PID 5976 wrote to memory of 2756	5976	msedge.exe	105
PID 5976 wrote to memory of 3036	5976	msedge.exe	106
PID 5976 wrote to memory of 2756	5976	msedge.exe	105
PID 5976 wrote to memory of 3036	5976	msedge.exe	106
PID 5976 wrote to memory of 3036	5976	msedge.exe	106
PID 5976 wrote to memory of 752	5976	msedge.exe	107
PID 5976 wrote to memory of 5828	5976	msedge.exe	108
PID 5976 wrote to memory of 752	5976	msedge.exe	107
PID 5976 wrote to memory of 752	5976	msedge.exe	107
PID 5976 wrote to memory of 5828	5976	msedge.exe	108
PID 5976 wrote to memory of 5828	5976	msedge.exe	108
PID 5976 wrote to memory of 3000	5976	msedge.exe	109
PID 5976 wrote to memory of 3000	5976	msedge.exe	109
PID 5976 wrote to memory of 5472	5976	msedge.exe	112
PID 5976 wrote to memory of 5688	5976	msedge.exe	111
PID 5976 wrote to memory of 5472	5976	msedge.exe	112
PID 5976 wrote to memory of 5688	5976	msedge.exe	111
PID 5976 wrote to memory of 5928	5976	msedge.exe	114
PID 5976 wrote to memory of 3860	5976	msedge.exe	115
PID 5976 wrote to memory of 3860	5976	msedge.exe	115
PID 5976 wrote to memory of 1192	5976	msedge.exe	116
PID 5976 wrote to memory of 1192	5976	msedge.exe	116
PID 5976 wrote to memory of 2144	5976	msedge.exe	119
PID 5976 wrote to memory of 2144	5976	msedge.exe	119
PID 5976 wrote to memory of 3676	5976	msedge.exe	120
PID 5976 wrote to memory of 3676	5976	msedge.exe	120
PID 5976 wrote to memory of 2756	5976	msedge.exe	122
PID 5976 wrote to memory of 2756	5976	msedge.exe	122
PID 5976 wrote to memory of 2756	5976	msedge.exe	122
PID 5976 wrote to memory of 1128	5976	msedge.exe	123
PID 5976 wrote to memory of 1128	5976	msedge.exe	123
PID 5976 wrote to memory of 1128	5976	msedge.exe	123
PID 5976 wrote to memory of 4644	5976	msedge.exe	124
PID 5976 wrote to memory of 4644	5976	msedge.exe	124
PID 5976 wrote to memory of 4644	5976	msedge.exe	124
PID 5976 wrote to memory of 2680	5976	msedge.exe	125
PID 5976 wrote to memory of 2680	5976	msedge.exe	125
PID 5976 wrote to memory of 5140	5976	msedge.exe	126
PID 5976 wrote to memory of 5508	5976	msedge.exe	127
PID 5976 wrote to memory of 4472	5976	msedge.exe	128
PID 5976 wrote to memory of 5936	5976	msedge.exe	129
PID 5976 wrote to memory of 4296	5976	msedge.exe	130
PID 4296 wrote to memory of 2952	4296	ecawin64-11.0.15.exe	131
PID 4296 wrote to memory of 6108	4296	ecawin64-11.0.15.exe	135
PID 5976 wrote to memory of 4336	5976	msedge.exe	137
PID 5976 wrote to memory of 4336	5976	msedge.exe	137
PID 4296 wrote to memory of 3416	4296	ecawin64-11.0.15.exe	141
PID 5976 wrote to memory of 1948	5976	msedge.exe	150
PID 5976 wrote to memory of 1948	5976	msedge.exe	150
PID 2100 wrote to memory of 4508	2100	msiexec.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\certifio-manager-2.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\certifio-manager-2.2.4.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
  "C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
      jre\bin\java -Xmx128M -Dfile.encoding=UTF-8 -Djava.library.path=dll -Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts= -jar certifio-manager-2.2.4.jar
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1284

C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
    jre\bin\java -Xmx128M -Dfile.encoding=UTF-8 -Djava.library.path=dll -Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts= -jar certifio-manager-2.2.4.jar
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.notarius.com/eesp-update-en/
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa2f76c188,0x7ffa2f76c194,0x7ffa2f76c1a0
        5⤵
        
        PID:5536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,10611113794710859913,12143295351789088184,262144 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
        5⤵
        
        PID:4928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,1938483894404873688,12341422378330491146,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:11
        5⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:3940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,2144617640754688830,1207927663171678142,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
        5⤵
        
        PID:5628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,4548033581402615563,17179206963854363963,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
        5⤵
        
        PID:2756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,15865823670392439744,16418832794353626447,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        5⤵
        
        PID:3036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2836,i,6805025345667046094,9168503507922281882,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
        5⤵
        
        PID:752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,6386008555716124294,12121755448009331656,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,4320889443794886168,3745994590879260670,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
        5⤵
        
        PID:3000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,11598955327351684686,10766343891327952364,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
        5⤵
        
        PID:5688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,11963519522557196369,7645649765500760267,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
        5⤵
        
        PID:5472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17244976273901479893,10016694029189575490,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,17244976273901479893,10016694029189575490,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
        5⤵
        
        PID:5928
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,11369234758097313244,12394386446167425874,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
        5⤵
        
        PID:3860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,12503544037635361949,1816881850125527551,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
        5⤵
        
        PID:1192
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,17935550736156519729,10552343373115144682,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
        5⤵
        
        PID:2144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,10508921632621711918,16074485702381084079,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6784,i,9889715585791181045,3117878225561110427,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
        5⤵
        
        PID:2756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5088,i,5192066578634829145,13616911920574571957,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
        5⤵
        
        PID:1128
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6304,i,14526544120248235594,14067124294214963505,2097152 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,13492237237400522022,3057727191675513193,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
        5⤵
        
        PID:2680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,3541097026188640114,9583394743651209591,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,6708101801629313380,9768630727609213832,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
        5⤵
        
        PID:5508
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,9941817804443032330,7447950635885110783,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:14
        5⤵
        
        PID:4472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,9250282777895800166,12261035526522686176,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
        5⤵
        
        PID:5936
    - - C:\Users\Admin\Downloads\ecawin64-11.0.15.exe
        
        "C:\Users\Admin\Downloads\ecawin64-11.0.15.exe"
        5⤵
        Drops file in System32 directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4296
      - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic product where "name like 'Entrust Entelligence Security Provider%'" call uninstall
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2952
      - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic product where "name like 'Entrust Certificate Agent%'" call uninstall
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6108
      - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\nswC381.tmp\ecaw.msi" allusers=1 /passive TRANSFORMS="C:\Users\Admin\AppData\Local\Temp\nswC381.tmp\transform_en.mst" /norestart
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,7368696768736897457,12020315756799868833,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
        5⤵
        
        PID:4336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14389356531960406032,7565827700714923754,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:14
        5⤵
        
        PID:1948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,10037729818315370201,6278352245583045063,524288 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:14
        5⤵
        
        PID:3224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,2043372855785460641,11008714312941597287,262144 --field-trial-handle=2276,i,10311263531933562251,2952803997855482354,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:5968
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x270,0x7ffa2f76c188,0x7ffa2f76c194,0x7ffa2f76c1a0
        6⤵
        
        PID:5180
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,12575934692820029278,1919061907563466261,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:7116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,9098671633982433419,6970644735448935565,262144 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        6⤵
        
        PID:2468
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,10084099151835578815,9669015546624998056,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
        6⤵
        
        PID:3116
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,6471507090349215558,4549080989618361967,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
        6⤵
        
        PID:5324
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,6471507090349215558,4549080989618361967,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
        6⤵
        
        PID:6724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,12894177191519550647,289169400018189073,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:14
        6⤵
        
        PID:6844
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,4359761305702680738,12047853070908855191,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
        6⤵
        
        PID:6808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,3947030717213437256,2233803689233115757,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
        6⤵
        
        PID:6836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2869250943158721614,6251766949709214013,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
        6⤵
        
        PID:4860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,5323365027738572862,11529447681401904096,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
        6⤵
        
        PID:4732
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,6322315726997533818,15862531377934085350,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
        6⤵
        
        PID:6976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,18291074934722891372,11689717096942787121,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
        6⤵
        
        PID:3712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,8889734957774437236,18011333130171015570,262144 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,8200857112364458860,3702229773369834006,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
        6⤵
        
        PID:4676
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4072,i,2863869975503292405,7907773876557829592,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
        6⤵
        
        PID:5364
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,18282315473334882231,14201662774220110447,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:14
        6⤵
        
        PID:3144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,6513691120176083806,17275500111289542739,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
        6⤵
        
        PID:6812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,10559348496662861509,15172945570842955606,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
        6⤵
        
        PID:3808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4569235843254296810,16581794398696911734,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
        6⤵
        
        PID:6436
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4112,i,16461203966169265460,3427615694201863907,524288 --field-trial-handle=2244,i,4561873256156577512,6271432137441923394,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:14
        6⤵
        
        PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5740

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4508
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6EF30ED3B505E826802601C36B9AB85D
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5768
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 41A6507164F4759474C0E9978E8DE6BC
  2⤵
  - Drops file in System32 directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1948
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeschmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6060
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eearcmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2536
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eemimmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6156
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eep7msg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6188
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eenosntf.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6236
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeaemsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6276
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecrtmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6300
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeefsmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6324
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeenlmsg.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6348
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeenlcngmsg.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6372
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eenosmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6428
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\eepiv.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6456
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\eecrtmgm.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6488
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eespontf.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6512
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eespomsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6536
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeefsntf.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6560
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecpvmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6584
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeshlres.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6608
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eepivmsg.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6632
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeproxymd64.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6656
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeproxymd.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6680
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\eentwork.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6700
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eenetmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6724
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eelsmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6748
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eespkmsg.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6784
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeepfmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6808
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eestmsg.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6832
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eepabmsg.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6856
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eemdims.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6880
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeiisntf.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6904
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eemdismsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6928
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeiismsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6952
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Windows\system32\eemdims64.dll"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6976
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eemdisev.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7000
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eecrlrev64.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:7024
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eecrlrev.dll"
  2⤵
  - Manipulates Digital Signatures
  - Suspicious use of SetWindowsHookEx
  PID:7056
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecrlmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7080
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeocsp64.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:7104
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeocsp.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7128
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeocsmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7152
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eefsmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6160
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeshxten64.dll"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6192
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeshxten.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6252
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eesfpext64.dll"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6288
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eesfpext.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6308
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eepeshxten.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6336
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eepeshxten64.dll"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:6356
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eecacertfind.dll"
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6404
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eecacertfind64.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6376
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecacertfindmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6416
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeccpbp.dll"
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6448
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeccpbp64.dll"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:6480
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeccpbpmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6484
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecermsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6512
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecemsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6552
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeenhcsp64.dll"
  2⤵
  PID:6576
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeenhcsp.dll"
  2⤵
  PID:6580
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eeenhmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6604
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Windows\system32\eeksp.dll"
  2⤵
  PID:6628
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\eeksp.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1232
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eekspmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6712
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eesymcsp64.dll"
  2⤵
  PID:6728
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eesymcsp.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6772
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eesymmsg.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3312
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eespevents.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6784
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeversn.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6824
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eecertcache64.dll"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6848
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eecertcache.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:6872
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\Logging\eecertcachemsg.dll"
  2⤵
  PID:6896
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeoicxf64.dll"
  2⤵
  - Manipulates Digital Signatures
  PID:6920
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeoicxf.dll"
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:6944
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Common Files\Entrust\ECAW\eeccpcx64.dll"
  2⤵
  - Manipulates Digital Signatures
  PID:6968
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Common Files\Entrust\ECAW\eeccpcx.dll"
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:6992
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0044D14D76B0B19275A6B18E83204EF E Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7040
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 60E8C967406ACF0632ABC7714B0FF8AA E Global\MSI0000
  2⤵
  PID:6584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1200

C:\Program Files (x86)\Common Files\Entrust\ECAW\eecwatch.exe
"C:\Program Files (x86)\Common Files\Entrust\ECAW\eecwatch.exe"
1⤵
- Executes dropped EXE
PID:6212

C:\Program Files (x86)\Common Files\Entrust\ECAW\eesystry.exe
"C:\Program Files (x86)\Common Files\Entrust\ECAW\eesystry.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6244

C:\Windows\SysWOW64\eelogsvc.exe
C:\Windows\SysWOW64\eelogsvc.exe /q:a
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks processor information in registry
PID:1188

C:\Windows\SysWOW64\eelssrv.exe
C:\Windows\SysWOW64\eelssrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6312

C:\Windows\SysWOW64\eemdissrv.exe
C:\Windows\SysWOW64\eemdissrv.exe
1⤵
- Executes dropped EXE
PID:6324

C:\Windows\SysWOW64\eelssrv.exe
C:\Windows\SysWOW64\eelssrv.exe
1⤵
- Executes dropped EXE
PID:6360
- C:\Windows\SysWOW64\eelssrv.exe
  C:\Windows\SysWOW64\eelssrv.exe /a STEELS_1_0105000000000005150000001C2433897672432EFB52E196E8030000
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6368

C:\Windows\SysWOW64\eemdissrv.exe
C:\Windows\SysWOW64\eemdissrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6488

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:6628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6332

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:1196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6092

C:\Users\Admin\AppData\Local\Temp\certifio-manager-2.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\certifio-manager-2.2.4.exe"
1⤵
- Adds Run key to start application
PID:6964
- C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\uninstaller.exe
  "C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\uninstaller.exe" _?=C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1500
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic Path win32_process Where "CommandLine Like '%certifio-manager%.jar%'" call Terminate
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5468
- C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
  "C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe"
  2⤵
  - Executes dropped EXE
  PID:3296
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe"
    3⤵
    PID:4476
  - - C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
      jre\bin\java -Xmx128M -Dfile.encoding=UTF-8 -Djava.library.path=dll -Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts= -jar certifio-manager-2.2.4.jar
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5384

C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
"C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe"
1⤵
- Executes dropped EXE
PID:6204
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  PID:5116
- - C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
    jre\bin\java -Xmx128M -Dfile.encoding=UTF-8 -Djava.library.path=dll -Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts= -jar certifio-manager-2.2.4.jar
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4696

C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
"C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe"
1⤵
- Executes dropped EXE
PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe"
  2⤵
  PID:1744
- - C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
    jre\bin\java -Xmx128M -Dfile.encoding=UTF-8 -Djava.library.path=dll -Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts= -jar certifio-manager-2.2.4.jar
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:7124

C:\Users\Admin\AppData\Local\Temp\certifio-manager-2.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\certifio-manager-2.2.4.exe"
1⤵
- Adds Run key to start application
PID:3848
- C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\uninstaller.exe
  "C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\uninstaller.exe" _?=C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2144
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic Path win32_process Where "CommandLine Like '%certifio-manager%.jar%'" call Terminate
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5464
- C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
  "C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe"
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd.exe"
    3⤵
    PID:5756
  - - C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
      jre\bin\java -Xmx128M -Dfile.encoding=UTF-8 -Djava.library.path=dll -Dhttp.proxyHost= -Dhttp.proxyPort= -Dhttps.proxyHost= -Dhttps.proxyPort= -Dhttp.nonProxyHosts= -jar certifio-manager-2.2.4.jar
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5b78ca.rbs

Path C:\Config.Msi\e5b78ca.rbs
Size 123KB
SHA256 25475178e63d577d48a0c2425a0350732c5f66760a28983accddf118f4c4e01f
MD5 9eb43c482e21fc1a70170044125ce088
SHA1 9bcd80b6d7efcc1a0d629a9e023f70b928a3d4c9
SHA512 f40aece7ac3836fd1361580877a7c496b73c2cfafc7107fa0a880a1e576ad163734c436a696dc2feccc8bd90cf2b09a9a21adebccaa6db3b4e1e7c4eff116e93
SSDEEP 1536:DlNC8t2JI5PDJvTnEyZElIxuK/Tw3+LpO5VVZmDwpFyB3ej7YWny4ipWIuRQlrPC:2jmzptT8
TLSH
T17CC341825A01D392E4DA1B70EA9337093736DBE86352875712DCC6708DC3BCA1FEE55A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eecerexp.exe

Path C:\Program Files (x86)\Common Files\Entrust\ECAW\eecerexp.exe
Size 692KB
SHA256 41efe170b5875ada55d84d63f0940341bcfa9bd0c1f133c3e5049c7f0af0cda7
MD5 16cc12d1004c0718222c85c5e9fdfcb8
SHA1 748e01434883759d9a5c25bff34179ab4910db04
SHA512 62326455b2623191b5e869a12c22c31592add1b5bfddedf33b0f18181fd471f1f3da0756723b34c1398df6c1dd8e4b550f0cd9a2853ae0a67257b1e4ca161604
SSDEEP 12288:GGfXR2me67HCmEDKM6XREKlskfMIy1j8P2tRovpTn5y8U:GGPRs6rEDKM6XREiMIy1AP2LaRn5yr
TLSH
T151E49E2338D6807AD6330231AA5E7775A5FFF9321B32458B63886A1D1D74CB19E29337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeenlusr.exe

Path C:\Program Files (x86)\Common Files\Entrust\ECAW\eeenlusr.exe
Size 54KB
SHA256 0b0d8ee938a8ee684b95c1e51777535427be400b87eb7b23e8e2f930fbf53c14
MD5 a8fefb76a0f1959d58c764f3e4157e36
SHA1 93fd6c81da189ff76ff08ae80ec0749f0483f9af
SHA512 2539150a7a2054f676a7293fd202b7f9549cc6ee309418da26b8804306f78b8b7f7c9c1d299d75ac0b77cd240832ecc8fd2b6f4620dc2cca3b9af983626ae7fb
SSDEEP 1536:6BtSSH77vAp/gtqZ0WuvvlEddbWFCqeRRKR:6BA6tqZEt2mCqe8
TLSH
T168438D43BB59C641E811153098EED6E57A77FC355B30ADD32391ED3B2CB92E0883A21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeeusr.exe

Path C:\Program Files (x86)\Common Files\Entrust\ECAW\eeeusr.exe
Size 177KB
SHA256 9ef13f44627353847117f493eca6135e843295fef8eda57330c8f0130bf330af
MD5 06bddf549374d42205ff29fe6d4524a5
SHA1 a1bb14eecc0780ac4e9473555bc9cb23e04bac5c
SHA512 d4121272b3dac153b505fef68460e020de5d171065fee2f4c7757eb91fc0432710e76ef1571ef5bcc26b2d47603e1825a8c50ea659d78b77e38086406f441938
SSDEEP 3072:gUNjtRFb8QeQy1EBYCVjzlNq9Ps+4X3buNy5ulPdxbCzdMqK07CqGi:gEHeCC8j7l6VxbiNQi
TLSH
T1F8049F237BD484F1E6B303304D99B7B99ABAFE710F2147233788270E6DB94D06A15297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eerecusr.exe

Path C:\Program Files (x86)\Common Files\Entrust\ECAW\eerecusr.exe
Size 54KB
SHA256 da7e350fb02bc2bb3087db5e1f858a4e91f5e4482a2910cef7398b57919d831e
MD5 c614b998c51889381e5edc45ec606a98
SHA1 6053ba9138b8ea544ba56b8bcd0aa8e1b6c60e3e
SHA512 ed9a0c094ac4e1068371b39322426469cf46550f21b5fbcec62d2d1f9e83b753894fd9b1aeb510103db66b77fb8fbcc92f683848ef7bcbb6e42a1b242e3d8bac
SSDEEP 1536:3RZNf6+HE8jt7c2x1qxUG0x8SCFB2HKuei2WFCqHRRKO:3fNfzt1xIxUbxcFBBivCqHD
TLSH
T128439F43BE198553D9055A381A92E6565A7BFC306F10A5E327D0FD2A2CB53C0DD3B12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 777733041e05cbb4cf2b8ad7de7f31f798a6f2cfff6a0bec0e58cb4be17fc2c1
MD5 407dacd85154396de09ab843474718af
SHA1 c284be69b6e508d455e24a97825c237ba230931b
SHA512 a94df3f492ca9926367446cb8337bf1ff22c45af8492b272654f625f36ee4de2eb0d7b62418098ff366c506ea84e03bc07e596ccba76f9d866f1744d0b459ee9
TLSH
T110D0A7D47C5CB6E0E132203D4211430271ED495675175107E0608C4E5C2869263F6AAA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 927183bb51d0b2f3c7253964cc1faa419c2653db13f546449cf653f15b88cd2f
MD5 0a31cdb69ccd1abb0297865636fabcbc
SHA1 6a73fa450a247b889d81d35d4d41da25a9d2f3f2
SHA512 92eeea44d4e2cd2212947d4f631cb866dc589e0139cd9c9a51beacd27201dc69bf0471b36a735ab9a3899d6b487bcba9bfd4b43722dcc5e2cb7f959de0742b97
TLSH
T184D023E5795D7D50D123103ED151930332EE595574278107D060494E581E791B3F956B
MD5 SHA1 SHA512 TLSH

Submit Download

598d3b38-9f10-4b4f-b6df-42676bc322dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\598d3b38-9f10-4b4f-b6df-42676bc322dc.tmp
Size 414B
SHA256 06011e66d228028f5e4c41cb039ee28e4c840237ee521055a47af7dfd6339cfb
MD5 8385fd7d9abbb98f596e5979fde0e59c
SHA1 4877f2f484f3e51443e38a7f11be8d87a4494d1d
SHA512 a8ece3df13a7d33963b7b7f27e03286dba4e71acb20ac6788d803eec221b71c436b5893f1f457c2212cbfc47cb6a2373c2cc6a98a03f2bd48eb439fec6497935
TLSH
T120E02BBAC821EC7708FE1B6DA0640746E780171B26508D4BB63DD40C4FB1A7E158585C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3fc66cafe667f00a337cef0a2e92f736f0833f9c1247b31f5ae08da9d9542e4c
MD5 16ec62c719a7fd0b33f044ba2e1f1c83
SHA1 9aad7f880bbb1786e6a21d244bd0778da79613ef
SHA512 7e5d0905220501183d8eda661d1b1d65927a5ccca2959e0bcd4685ed7360f93aaaada9609a4f43c05e44594554358678f6f2dfe0b2080dcab45968df39594f9f
TLSH
T1D1614445C36519E1CB711AFC91E19E4B3A788DFC0B2BAF0E4878E0B1D9DA79B6525013
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 65315d7733138847570d81c51ec4d92698da0e03412b484469012b59f9904bfa
MD5 124330b1ca4979aa5accedff610e71ac
SHA1 13a7e699d27e7740cc4f293996d9c6ce12306d67
SHA512 133968b595ec0fca56c1752a5b66a874bc94efa91820dc0a175c6e75c1c7990e0a2baba7eb8f1f662f9e9d6666bcf5d7a8536970ad2e03b4c092c1af00c3a966
SSDEEP 3:MsEllllkEthXllkl2zExllHdal:/M/xT02zIdu
TLSH
T1F844020CAB800405C50051304062839007B4D51019316B4324D204236D865400C00010
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 929859436233ae5193296d8e22e35ae0cc1447d918d710f0ef23ee6a2062b263
MD5 5bc8a1824c77add89cb77bb01c5d55b1
SHA1 b1f1ee5de9479022decb1c66ed2d70a55c1698c9
SHA512 e316c924de25f7be0099a481a7c5087188a39224a61aaa754100299c20cbcb1c8324ae3bd989b63c53ec89a1ca19e62c83dd1b4c439e004ec140ef547e77b2be
SSDEEP 96:DGO24e9uOzBKYVe4EqBuvvSisMc+og4vRkwQ:Dl24e9uO1KYVe4E6uvvSisM3og4vRkT
TLSH
T16EB169F7C3E8966D8D2151F0AA156E1BCF2D0911972C3D1BC4E5EF2BA3E2460E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2f7ecb941d1fea23ee3ac414cc50b24967bbe8709bdd5ce04120b8cfbecfc548
MD5 b2acf223c8a8183f38c2f7979e6216ed
SHA1 cd45d0ca1e850561e215a72562391bde2cf7cfe7
SHA512 48220303871f12c48c767d4de4d44b8c1adb5ae93ecbdf8b95664a41867592454f1ca98ff1fb102ab1f76e55eaa03803c714a0c5653d23321673483b4589c937
SSDEEP 96:DGO24e9uOzBKYVe4EqBuv9isMc+og4vRkwnx:Dl24e9uO1KYVe4E6uv9isM3og4vRkqx
TLSH
T172B169F7C3E8966D8D2151F0AA156E1BCF2D0911972C3D1BC4E5EF2BA3E2460E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5a8b50276a0eb5afd8835f22c8a2826dacb7e51c35ef77a54c9f54ea97e1759c
MD5 6001ed4bc05a16d865858cb9a0ef613b
SHA1 0457e8c5eb88886fad675c26ff0fee4008ca1274
SHA512 7f0cade6a008ef1c5d38c58420ad1fb21d4a5c60e5a4917dec9318ef1679b38f18cfb322cf5db8a7a565f3e22951b6bd0a8da1c15fb16fb40534583068a8a79c
SSDEEP 192:sxRIRpyM/jK1Ml8wTy/fpsANe2rZMCOqzoA8pmfpy/g6+WNy1rXT2Rl/HfXxxAlb:sxRIzFy/fpsAlFrOn2y/5k/u/b/s
TLSH
T11E72E716A93469778CDBE609FA41BF63D3F91163D1901E44AEFC8A1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f9dd41ff5bb44f782eb8539277994fa3002875ca33befc12d34154a07683a136
MD5 aee007d238fe981699ba5d03c3997b82
SHA1 4b19d978c26c9a61c4fb06d402d60831abb95378
SHA512 f9591a0b1641c01cbebfb5ba54d0cfe55aa3721b47c52cb2889ab07e4bfbcc7abf5552b77ac5eb9f03d5ef8758c8ed40aac703091c665833ce8f9c1eabffe5dd
SSDEEP 192:sxRIRpyM/jK1Ml8UQqTy/fpsANe2rZMCOqzoA8pgfpy/g6+WNy1rXT2Rl/HfXxxv:sxRIzqgy/fpsAlFrOnAy/5k/u/U/s
TLSH
T19C72D756A93469778CDBE619F641BF63E3F91463D1901E44AEFC8A1C00E6AED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 1def09888fd515af6a5a9e8a5cc55c4472fc003366a639354dd76935bc17227d
MD5 64bfd5ad2fb943e73c25bea02daed756
SHA1 8eb678a192a899a89d4b144a49f5fd46cee51fff
SHA512 8e7a42b798a144ab2ba40b8a24358651436211992556f740a5b7c7730bf15694edf9791e8bc35d4a126376002a55a4899a50425f7a6497226d47d5e2b9b86a2a
SSDEEP 384:sxRIzqdy/fpspWvXlFrON9Ay/5kwu/Ias:sMOdy/fGYXlBu/5k5Ix
TLSH
T14882C616A934597BCCDBE619F6417F63D3F91423A1915E44AEFC8A1C00EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8cd2028f07e7aa6ee66dceef9eaef33420bc87debd9f3a4780cb60046ac09909
MD5 a40330f3d915069df7a6bcab8ce44872
SHA1 d8ef66ce443cf9d9fd1ee4585c9396a898fbe0d0
SHA512 194ee9111e1dfcab616f47f246062b06bc89654c85802e47ce9823ec85fe4e893f5c06b12d2d8659374aa2afaf5522215f19e670c0791837edaa5e7d3324ea35
SSDEEP 192:sxR7RpyM/jK1Ml8wCy/fps/7e2rZMCOqzoA8pmfpy/g6+WNy1rXT/YxGlJAYGrIU:sxR7z8y/fps/LFrOn2y/5k//K/1
TLSH
T1D062E716AA34597BCCDBD609FA457F53D6F81563E1905E44AEFC8A1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 abc8019ba9ae2d35a9c3f37bc592bb01d4914110a317fb44c44c1a03cda24126
MD5 92484087b73e8413351596a5683a8419
SHA1 2c2abd1da1b677579bf9ca6c20f7ce7e97f32b5a
SHA512 170affffdbb533aa5e7ff7956540d0ed0fbaea1dac55fd765b371e92898f3a56558802704ec744fc3b2d19ec1dd3d14fa5368d3219fe485b16521ec571a70da1
SSDEEP 192:sxRIRpyM/jK1Ml8wCy/fpsA7e2rZMCOqzoA8pmfpy/g6+WNy1rXT2Rl/HfXxx8lr:sxRIz8y/fpsALFrOn2y/5k/u/v/i
TLSH
T12772E716AA3469778CDBD619F645BF63D3F91463D1901E44AEFC8A1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 07dc138e77a6fa3310e20c9ee0c2efd1e394c1970d6527df25995b0fd2da316e
MD5 81f54a48bc61c599c0f72fe1d4d8b53e
SHA1 1da32e13fa35ff406e67ee2b7eb194e0957fea13
SHA512 713fddc8c7dafe6662fab22487ed056cfb02eb0041c4d3fbe9bb5ee7de4a1f9c16108705eaec591229f0e122f0549f9c12bdaecedea04f78000af179b82f4559
SSDEEP 768:0xCyG57pLuLzUjWgbrfK18F1+UoAYDCx9Tuqh0VfUC9xbog/OVbpHrVAkroJGMl:0xCyGPEzUjWgbrfK1u1jawpHpAvJZl
TLSH
T1E6E2EC7B680CCB7E4F404A9DEC297EDAADA802CB96D8C95447EA480C03C67EB51165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a66bf750969a53e629aa6a82fa51f70e7ba43c8b4c1e440de57b7053161022c4
MD5 054084691d79ae99f6fffc06ea4a09eb
SHA1 4e57073965c51a04bdea74c918f60a41cb0029b5
SHA512 f509f00a9be579609941c9242793898f733ce0bfa4b5a7476850a896b2014c291722b202361c2c713f33c6ecb629c1356b28e02ef333164c5d678eb0ededdd83
SSDEEP 96:KgLKKwYCyWYK7iZY7sYSyCCE69xmoCKOnmeCqIA1mYr7wTkwqKqKEi15mAKKO/mo:UpHGpVN
TLSH
T1B1B1C696B17A164028BE260C92E4EA17D6D170F33468A42B3FE814F55F66F425FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8df7bfe2-8307-407d-ae5b-7e3b39d64e87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8df7bfe2-8307-407d-ae5b-7e3b39d64e87.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7662b54b9d2d823a5036abdb1765132c0bc02a2da3c238c319bcb2bff04a1665
MD5 b06a61129135bfd6d201ccc18eb5f1ed
SHA1 fba9fab7c90a11c637d9dbc303ab9e5725f254a5
SHA512 26a91ead43afe183881204a77e7caafc2de71ce6c164ce65c6aa832e674e8c3d44680b3c792554b210df61169666121dc74732a13a1d7933612b969e89571ac1
SSDEEP 768:arv+4UNbdl3EPkKL22ejF669yrqUjWiIwwxMRGSUiler:absbX3b1jF66INWZTMxUsQ
TLSH
T12603CE31AC589AB7CCF2D68672533783BF74109396C50B88CADC670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 745115e93520466b12fe5ced45f55efef80a8efc377fe9473a5174d7f70ffed6
MD5 a8313c690dcecfe7e7bc699a169762a3
SHA1 ded7c73da1af95d4870abb65da38346a76ff3f87
SHA512 644a904a3a55ab498112cd2d588fa95e21d67ec3fa908dccdefa4a1f2751adc3ea98e713f064eff16f2783ad2080a333c9ab253947a83435cda0abe6d462b181
SSDEEP 768:3V3cSDkKL22JjF669yrqUjWiIwwxMtFfA6P:3V3cpMjF66INWZTMDfA6P
TLSH
T1BCF2BEB06CA49DB388FAD785B21233C6AF7400A395C94E88D9DD971E054B9D92B47C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 79d17bb8b2617d2d52e47e9459c46d244ca619b05dfb6d4666e5b6a6e4eeebd2
MD5 aaa1f73374c4a34767ce77eb33afd9a2
SHA1 2da5a5115b60ebc812ae0fa019cea1246c9e4b77
SHA512 04a6a9e8fc2597477c777b4b486884f382433410fce64a233689db9397e850960f7851a6425f5430b8a86bcdc21dca2d25cb81b8e3e67aae419a900299bac053
SSDEEP 768:OFlR3TwgEQoo3PF669yrqUjWiIwwxMtRC9vefA6P:aR3aIPF66INWZTMzyefA6P
TLSH
T1FC33F5F89CD3897AC4ADA787633D2D55997CC173B5A88888F7884B0DCC624BFE742815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e137c79e94785b96bbfbebe4d0ec2baec13618514f190ead817bf92311832253
MD5 c757a1dd2c2e5c05e222f8bccbb24386
SHA1 fa059321407649e633f194cdddd1b0772bfce24f
SHA512 8306328c45a38aafb0ddf110b0f6ce4c03ea86196850bb4a6957f0e8242d4e7b2cbba7055b0f49022f7a5901e1906bcf4ff64b5d36a52742d080d3cd56267cbd
SSDEEP 768:e53cSDkKL22JjF669yrqUjWiIwwxMtFfA6P:e53cpMjF66INWZTMDfA6P
TLSH
T1D0F2BEB06CA49DB388FAD781B21233C6EF7400A396C94E88D9DD971D054B9D92B47C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 db393bc3b8c0dfc883e6ce12772d4d3713b1b345f3c340f672f193a2c95356b7
MD5 2d22b975b08cce66611531aefa2c2f90
SHA1 0a02a4c48dc42821cd7207396b2b3300040c6949
SHA512 76f3bf9802e99d8aa7c32d74b42483a9d06ca522e91c33c9c68560a7d558c047a72077d3d5d3535829e5657c09391ae3864f231501e246c27fa848ed9579d33d
SSDEEP 768:OF/R3uwghICovnF669yrqUjWiIwwxMtFfA6P:YR3ucnF66INWZTMDfA6P
TLSH
T1CA1329F198D39977C8AE9783633D2E869EBCC0A3B5894984B7C85E0CCC465BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 99KB
SHA256 3398885c7b194e827b79f14512f76febb106d2f9a5765a8403aba0d609d0d777
MD5 d7809401e914107d732364d5222df13d
SHA1 c0dfe48b27d8ab543d1321e9a36551230b68dd7e
SHA512 77a383f4d217b2af52c7786c6019003750ed89c59038ba6d55986da1c133a37b18579a7eb4fbf0ec52e9f31b4d062e5c5055c38264c2bd8d787fc138de53c5a9
SSDEEP 3072:ohE6qfYtSN6xEVxaCY9weRSnMpE2isi/JZu:+E6e046exabwzIssi/JE
TLSH
T11CA3BEF89CD3853AC4AC9783A33D2E02A9BCC193B5994594F7C89A1DCC665FFE302911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 287959f757d9323aa3ba510b76ccb37f4fe775bc001efb1c7ccd2c2efacbd4dc
MD5 eb5021772f67d12125f9036df2c6aa2f
SHA1 9bd9d20f9b7c261102131aaea5797fe89daf6bab
SHA512 08496f6b4f58017330454331a002bc36a7ae8844a5f1ace327c2d8c1e7ff22ab80ce2f7f20105a963fc97139babdc40cbbb039b1e793999008d37e58230d2387
SSDEEP 768:/a3jeDkKL22JjF669yrqUjWiIwwxMtFfA6P:/a3jNMjF66INWZTMDfA6P
TLSH
T1AEF2BFB06CA59DB388F9D781B21333C6AF7000A395C94E88D9DD971D055B5D92B47C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6b07661ea4bd038c4b7c378a980d0e9e14e1bcc982537b8fa06892f31b7f365f
MD5 0d1ff4b677bc3dff111203a29cc71737
SHA1 ac6d8b57d97b72d88cc2c5ee00b8862c80d5e120
SHA512 dac7a23be795011275d88c02fb1c5e2c4c20fb587305459b47539f52485a9c291b4c79f3c08bbb364f02da722cbd487b937e08d70d666efaf2f64b6118c77415
SSDEEP 768:trv+4UNbdl3skhkKL22fjF669yrqUjWiIwwxMAFUiler:tbsbX3sNgjF66INWZTMEUsQ
TLSH
T11903CF70A86899B3CDF6D686725373C3BF7420A395C10F98DADD670D064B4C92B4B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 612B
SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
MD5 5ca920f0e1c81dfb329b916e242a4065
SHA1 1d068ad79883fd23c27647c98e761858e46f48cd
SHA512 2b99239123f922883dea3137835bb8b74713799981e5aa1434ea70db85e7666f2372db684f94bb599ecff70c8c31d02286b0587ffe620333eb1d4bbc7feb84b8
TLSH
T11DF002D04C3E19C3D5B90E6EA40717EC50D45517B0D8383804CDE894D07A05E315183E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 732B
SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
MD5 87299a8105078d6252386ba9d333ff05
SHA1 c43e027b4174d2ae2c7f138de07b18ac0407148a
SHA512 f6678cce079ae97838bf5aebf3c195a2c82d27dd6546fd7e5428396130ca4bd2c809f2d2edca4f130da479624c3418beffe998ae1a032451706b9a47bad62885
TLSH
T1670110D14C3E1AC3C6B90EAFE04717EC40C89512B0D8387818CDF8A4917A41E345182E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 972B
SHA256 4d2b47e594a4d5d9d0c079c2ff5fac0e47e26ffad46c371ad51e472b3dcd0669
MD5 54b0cf5610d4cbeadf10f35941bea007
SHA1 8bcec79787775ec6c2625b88611eb0de385e393b
SHA512 3f6d82da490f1b52647d9f376be4aa3159f57072ad2b52a048895bf7f53255d860bc12cc4b5af53cf9d9ce8c76cfab722e47cef3b58fa776a8ffd7e991630253
TLSH
T1841184D00C7F1AC7C6BE0E6FA0872AED40C8A622F09830381CCCF964917901D3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 852B
SHA256 cc631188ae4a22c0621e596be3d4335218373ee3aafe98bb7b213069a0dc3b70
MD5 1a8162cc03c34509f59ea81728419884
SHA1 459f726ff17ed37a212bf5291cc592b4745c3c06
SHA512 129393fb77432dda8e2c4181dc778f609f56572e69213f9f8cffc544b845119929242d41078170b2dc72a678116df340544edb181c2aff069f8cd4ac2a541083
TLSH
T1E8011ED14C7E1AC7CABE0EAEA0872BEC44D86522B098347818CCF864917940E3451C3E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 68dd4a6a0b1711003690c2995fd0b77ba3c9ae6c27dd853ff492b52bd7701bc5
MD5 bc900814bda342e30ca622ecf6edf1a1
SHA1 58549077a989da91156012baf9dbfc98ecfe429d
SHA512 c918bfea1c94a06e69e13a1edffa87e69fd698fc8ddf310fc5545d1e2a80613e7617e19110e5496fa91c8e8037bc67a81e300b571bebefb407ab16a384d97fa1
TLSH
T124111FD11C7E1AC6C6BE0E6FA4833AFD40D8A622F4E8307818C8E964927951E2451C7F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

08a2e00c-b691-4d5c-a1b1-78e53b3ba6ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08a2e00c-b691-4d5c-a1b1-78e53b3ba6ac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5a4e7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a4e7f.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

71e15f1b-d44d-4968-a395-397cd7254420.tmp

Path C:\Users\Admin\AppData\Local\Temp\71e15f1b-d44d-4968-a395-397cd7254420.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

imageio1961884389240524185.tmp

Path C:\Users\Admin\AppData\Local\Temp\imageio1961884389240524185.tmp
Size 321B
SHA256 d358d247413b5c48c077b1cc2593340dbb07aae9a2d1400087282229d391c03d
MD5 525fc89c32df29c6a05ec05b87fcb740
SHA1 fdcc49ba1607592333d72d8ab53b9091dd9ebd8d
SHA512 5fc7fd374e6b33fafd2d6bd4f42fe2b7e10bafa507e3011cc5462fa4efe2892dccdc179aee835d69d1e369053cecbcfb3312eef1418c0f81b77eecb0fd02932d
TLSH
T13BE07DCDF3083CBAD57C629714812B14F0ABCD0E40C33941578B8C221D67A58E9A8201
MD5 SHA1 SHA512 TLSH

Submit Download

jna2333476976029749521.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2333476976029749521.dll
Size 203KB
SHA256 785eb4bfd84970e5254b6fadb5d6eab96d690d513f754203f66f0ff6eae1d84b
MD5 e37dbe363ebe9fdbae605a072408e729
SHA1 57030f58695851a95fac94d105aa2ac074fe1da6
SHA512 1c9ffcb38af1e2c6a4e2f58d45c0f3b37e489c5f5006ae8d05756b664e78093a44cc499349c4175921984938d21bb90a23386fe86a1b4c6432f60a42f1ae2a30
SSDEEP 3072:CpCs5aH3zUPldZNMIYTCvLeTyg05l4Vbkp/iYYyVoSzbYdhqBx1lm7:ArsyZuIYTXDAlUSzbYdhqW7
TLSH
T1C0145912F040D4BAEAEB06794175C7552D7829302B8098DF17C5AEBF0F359E0FA35AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jt160468.tmp

Path C:\Users\Admin\AppData\Local\Temp\jt160468.tmp
Size 2KB
SHA256 7e7dc8b05d07e7e9a43e2d2f03ed471dfc5243536d5956897b8366616e800907
MD5 4ed7d0bd7666c3100a45e3ba49faac4b
SHA1 438080c9b121ed306bf0194b21ea5e170658af92
SHA512 4e2447804559b7fcf0417e04ba0ffa885d42d2c5e4e08cefdef45c29c8713950776980209927e6c575cafc2e8c22d1b31b6e234452faf5c16c0dcdb154c49ef4
MD5 SHA1 SHA512

Submit Download

jt542546.tmp

Path C:\Users\Admin\AppData\Local\Temp\jt542546.tmp
Size 1KB
SHA256 4cf4eba59e3eb4f66ace798ab454d645c66e7c55512fae7890a9f8e9dffbf3c6
MD5 e666783c6e5db09f0c5b0d8ff7bb7ffa
SHA1 6a1e9b3d5ba1b1d493bb95767290c5cb78208873
SHA512 58bd6136aaa527a08d99edb88d40639aeaa9562cef168cd98b51034679a47059748241e347da4280ade762ea5bdcb95b1c2c3fb43d4f11116fd83c7e4c858270
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg8631.tmp\nsExec.dll
Size 6KB
SHA256 114c6941a8b489416c84563e94fd266ea5cad2b518db45cd977f1f9761e00cb1
MD5 09c2e27c626d6f33018b8a34d3d98cb6
SHA1 8d6bf50218c8f201f06ecf98ca73b74752a2e453
SHA512 883454bef7b6de86d53af790755ae624f756b48b23970f865558ba03a5aecfa8d15f14700e92b3c51546e738c93e53dc50b8a45f79ef3f00aa84382853440954
SSDEEP 96:pBNUBGfVwhcAlhPRJAixx+3eDEsgcBbcB/NFyVOHd0+uisX4:qBGfV5AlJJfFgcBbcB/N8Ved0P
TLSH
T136D1D63B6AD029F3D0498930286779368BF988360F614210EFAB19E535E5DEBDA20647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nswC381.tmp\modern-wizard.bmp
Size 147KB
SHA256 6805339b683766342d2be795360357099851661f5acd1434c43526ac6a7258a2
MD5 cc177d9f2b08c041f048101c4976b8ea
SHA1 b705c8ab84c4c3cce1c42893f2b3f31273eab994
SHA512 13722e9dc6069d5f5960b2953fe4b1a83973a59ca4f3f485fe2ad7a2b0d131e40396be6006e159b615f9779bf5b54c376e3994bfe1dc5935a53e86d56558323e
SSDEEP 1536:Aw28dD9O5z47PEc4z5gTTcGcba8FN3Stw7cAPdS3dePiAYwAc285wXfsw8CSmpUO:Adma058FNifqgV4RG9vCImtrU628aFZ
TLSH
T12AE391840E2C5A85A072D49D7ED11ACB68267BF2FDAD5145B429732FC7E00DE287E0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nswC381.tmp\nsExec.dll
Size 7KB
SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
MD5 11092c1d3fbb449a60695c44f9f3d183
SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
TLSH
T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

proxy_vole6295473528797826931.dll

Path C:\Users\Admin\AppData\Local\Temp\proxy_vole6295473528797826931.dll
Size 42KB
SHA256 aa6fd3c1caf2a53d1fba496564dff15d89779bbdf8f132917eec30049adc9678
MD5 22736cb1c85cd187a2419f0e55debbf7
SHA1 26774827e60e1fccf13365d23610704efc1ea615
SHA512 e042f4006d7eccd38d5c6819c20e108577b06de71d99c3256af15f52e6c92cb8e1f9323e9e45047999793509a0fd0b4b122e9260b347bef23691491ee4e5259c
SSDEEP 768:BA1sfWGoTvx5TLns5WLC1z51+iGz01pghoMROs:G1nT5RnjC1z6ypmRO
TLSH
T173136B107541D073C01A6539956ECAA18EBE7D151BF1608B7FBB1BAE9F312C0A33E34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5976_1813560761\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

certifio-manager.cmd

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.cmd
Size 342B
SHA256 b16a3e4fcfd992464fa5bbeb77acbae1f0bf001b3b03ad1edb9c485183c9a142
MD5 57e8bb2994b33b63d77d7bf3ca37fa28
SHA1 fb08172b7f26f567811ac4c4876ac4a7a9bf654b
SHA512 c819c38f10fbf192af21c729206ade2fb5461767621c145b8010209a0dcf3675643b74bd72e078f2e7a16328863258ffb9e6d49a14aae24d634c14f236136559
TLSH
T1FFE0D8F1B135107EE1BC0F406069BFD8E4BE019F21C544AA06B039AA6D179F1506B421
MD5 SHA1 SHA512 TLSH

Submit Download

certifio-manager.exe

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\certifio-manager.exe
Size 382KB
SHA256 e2f1eb0086ca0bfa4030e591986a2b36dd5a078cf5a2408fd5c26a4226204ef3
MD5 8c3d84bed71618e139d8dbf03f6de719
SHA1 c473e92dc734c3cabcd9807b1ca6b852d2fa34e9
SHA512 16b7834da062d45bcbf8e6337e3c79b7babd9ce1701eaa914c05b30a8692fe5609fe49646bdaf029c0eaf13754abe51011e255568e3c98981f3925ddfeb1cae2
SSDEEP 768:x+jfvPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPQPPPPPPPPPr:x+LDpeJV8BZvKZHR
TLSH
T19184681D7F4096D0D8968B362757422F3A9ECEB3E9F9014AAF3476540AB25F704AD03B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application.properties

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\config\application.properties
Size 2KB
SHA256 dd74e4c91aab7aff2caa519623a840b9526d01b2a03d26f4686b928c411cc179
MD5 2f8d3fa4579b23cdd06f6e0ae82386d7
SHA1 6cce97e5a22e9d3e77ed9aa9f5aef2c9c7ce5d11
SHA512 cb74c7bbb5f67a8132b2632235926089cba94dfde7f4732dd5ff1cd1a52115aa56e3395f7b75a7b0a45e87bcf986b37bd177e158faa125b0d39cabf08fd36335
TLSH
T1E941D94B23CF3CB7896F43B739C437A9651A028300E36553A5F8CAB93606DE58B59833
MD5 SHA1 SHA512 TLSH

Submit Download

log4j2-file.xml

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\config\log4j2-file.xml
Size 944B
SHA256 663a532176b20dc124c573a4dbb816d9225f9d484a294b9d6628a385d49ee54f
MD5 28da81e90c37b363ad8edf22a0aa83e8
SHA1 74332aa83028069639b1c77280330a0491773b6b
SHA512 2a770184bc100e45cc706380aad6006c8134ce7681d173c332a9711e106e07c5f5e2debeaa45b5ed2d4af9b7eae20cd1b76884670116511bc8864b73430df7ca
TLSH
T136117A02B3EC7F0FC8491167D47F5C99A61FBD1B243A6112F1E9393B624B6746109267
MD5 SHA1 SHA512 TLSH

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\awt.dll
Size 1.2MB
SHA256 dbb55acccca767a5c42bb6f6695e4e6d4b226d4998104999fb9aa4ad3c01dafd
MD5 f8e7e53fd950baf46ececd3b6da2b2e6
SHA1 ea6c8e7434e831fd5fef9b3202991f4caead2452
SHA512 ad49fb139f19d0bfb42932962f0867111ed66ba367dcb2019b56c304123974cf57d45ebb2b5075c5ffea30df289ea9f8b3f9f8836ece9596f71fe3b7d9d79ce7
SSDEEP 24576:k8XhCybm8tMZeC7BcGyZwqkmZXC0K+XZaOX3zxnHfsU4r00McZI6jyR3DeI/UqXS:TxLJ34njU3DNX3zpA
TLSH
T162459E42A6D290B3F44E2230351BF72F5776BB440B1AC6D7BA94775E5D313E12A3328A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.dll
Size 141KB
SHA256 356771ccc7f475904417f62cd5575c8197353eb9a2bdc5f0077f49d8bc8a152a
MD5 46c555e3f9880ddb9d52e2383eead38f
SHA1 d0c53b4b83759f12f974fac8cc266e07a30c5e4b
SHA512 53cdfbf9fc7c0d1188c21777a86ef4c4cb751450ae176e06c8c6429e8b79d3f82a416b450690068f1f7029ff73ed4623ab721b79f7a8d79f1d3e26d2c2552a36
SSDEEP 3072:7IMaOw4LY5pF1lBtYENfQl8erUqN3GN7esr3cqeJTxzOr/+:7IjOZLY517tG0oVuczMG
TLSH
T15FE36C0373B4D05AEAF1383C242DB73DB2BA9628B4FCD9431B204599569E2326D377E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\java.exe
Size 245KB
SHA256 8a842cec75af1112aa35a3cbd788347b652489693ce96d22f1c068a8f7eb1ee6
MD5 b9bc319086b18edbe4f7aa3b260791b9
SHA1 3f78443b9f766b4c6e043d7446fa9b29f740c137
SHA512 27f7f316945ea51494fc7dd9a987ef6d9398c5febe4c35aa8fbe3af334897e641e70744c3bcc2e3a58e83b6337d77a3052a408b2dadf720153931bd3d599b62a
SSDEEP 6144:yfILwnW0F/esoyh2sDDHqF+zDXJDo50m7k/OJQkxu:LKzF/d4sDDNDdY0ZGJQkxu
TLSH
T15F34BF617881D471E473143504F1F7320A3DFC311AA49A9BABC9677A4F312D2963BAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\management.dll
Size 41KB
SHA256 527e9d2723d6e50e10ebf9512e6ec79693d9d06e71b0a2ec3b4fcb053e54c983
MD5 62882bd3802d5074297d99c59eeb3c67
SHA1 87a981a2d2abb617ce7c680a958341e77a891ae5
SHA512 16fa418c1316bd0ae2c8833b37b30c827d34c834aa139e05934f04fe8357f2c7d7e21de20afce7b989314d1c4aba4500ee2081192130ac3bb758834508b64a07
SSDEEP 768:tCndloa0UiDoMEyWzzGMDNBBFtTAvy1cFx7/Yi+B3AMxkEkXX:ika00MpRMxBBzTx1Gx7/7q3xYXX
TLSH
T1FD134D13A79D5483EACB793330800B3B1576BA912ED09A4343B1C76646BFDE3B63A175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\msvcp140.dll
Size 438KB
SHA256 1e8a905ffe6e568bee39a05742078a173922ca9d0fedf51b0a7df66f28410c68
MD5 6a2eca57357ee39eaa5961c03b7a647b
SHA1 21d63acfbdeae192333bb9704cda8c3d7bb0aca3
SHA512 ed92f47a749eddd6f32636f00a97571242a27b41c53556ceb34578b2a094dce731068fd34b2e347079ff98f44557161e20793e3f085d680c6e0eafe4bdee67e7
SSDEEP 12288:RcPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWBPJ:RcPa90Vbky5CvyUeOKn03Ooc8dHkC2eF
TLSH
T170A43922BB424DF2E59E53B671C6532187F5FC250760E3C393EAE0296F662C26733691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\net.dll
Size 90KB
SHA256 f1e42a7b7090ca710129ea17fe48a17df548cfe048744b586e7e7d3acffe9c0a
MD5 2f1aadbcfefe5571a9bcee013f7213e0
SHA1 fb5488ee28d7701ddb3ff738089174d468690e50
SHA512 eb0e2103d6370304c38115e0fbb7bdc38b7d34a22c86bd34210610a4ce82d3e9cc1ed328540abe4848c5cb9034e449e3f112edf9e2b213946e7abdbc2d89f8b6
SSDEEP 1536:K/aYZ6IjuQKlvYeHYpZeDUV3HHWIxA+R6GxxOkToRejQqp///7Zx2:K56GuhlvN4pZeDUV3HHPOGrRjQqt//S
TLSH
T129939D03F6D4D4C6FFB228303159AB7B92366930F850AEC3431699524DBF7A5B936782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\nio.dll
Size 58KB
SHA256 bbe811cce542c8b4fff67d9422930585f14156d4e00bd6753d678000b77bd181
MD5 30789b53214b7b42701fc8fe6789cd78
SHA1 daa1d0d0f2cf7e7d1eb7fa8e07bdcec2031d535e
SHA512 f40959a03e72910eff7a89f6c69d958af33d5b9d09492ee70421d94778bc2281101abce101fb4bd2a9e6f309d071b72f9836005c98d73a99e5cdd5f88dc73d8a
SSDEEP 768:qzawLKx7PUHTdFHSEtYjaAKfHdKMplc3KSUb3H8qQMh+VgVoscNHUM/Yi+mfKAMo:qzawWap5BtY2cWcqrhOsAHV/7vfoxO
TLSH
T139433D729750CC93DBB23134766E269D3322E8109420AF5B53124361DC5FAB7BA3FAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\server\jvm.dll
Size 6.1MB
SHA256 f7516f41d6605863f70450b35cac440e54410c89546bc2ea395e411755a8b723
MD5 ddbaad8388dd0fe7a33046e2600fd229
SHA1 bcbfd577303cb047afa3bb81cbcd1efe5c737f81
SHA512 86152628dc4779bee74f565a867966e49f43c92f16dc65eca9aa4557a10c23484a4130c77bd0b51d69ffeae4838493ee4d318d69be5e1304b1a9c0d11fa49b1f
SSDEEP 98304:YJt2rAdY/UVs0AYwaM/Ck1wZMXsIU4XZcWycqiYebcv/GFb2nL:YJt2YY8mfY/M/Ck1wGXshscWwocv/GBs
TLSH
T1E3568D21FA019126D48663F99AFDB77D6079C3B2432A51C367943E9806706E31BF72CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\sunec.dll
Size 142KB
SHA256 7dc3073496c5356c3d265de95654cb1cbd0b596806c7ff971297640e4665a1ad
MD5 4d40e63a44d170504a0109c836c5f223
SHA1 76163ebdffb4a7394f36bf853d9d66772a8fa925
SHA512 f5de28acfba7237e8b3e36d8995fd1a46e6d956a2c21b09ac3d43812f3f28176b502b5cbecb02b6e7890f3f7630f330f46615ae69715a81e8f7fb040fdbf7bfb
SSDEEP 3072:Skd6NoVDA+R1pXULHq5wJOXPuCS/h+Ilo//UkqimZms/L:du+Czq6EXPub/h5lo//FaD
TLSH
T1E2E33883F2D344E1DA8B043AB4DA772E1F347919F4D0C9B2A7774A4BEE716419C1D2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\sunmscapi.dll
Size 39KB
SHA256 64303da1d3544a9624087b3324b267b9b923d01a6b90885df2918962465d40ff
MD5 b95a2538ee9944610f584e3f20bf2203
SHA1 f3cd7514fe02b7d7cdfe7a1a24bc751e19598354
SHA512 71b1f6bc450b86e3295f6fa1769e873f056a1631fda7ef057bfbb0bc020337be119e73bca5cd140ae16d4f4707d5f1ae91df444ee005a4a0a977dc80b70012ef
SSDEEP 768:F52KP7fw/LYAjqEAtMFb/VnjR8nEs0m4gsri3qil+dt/Yi+hdAMxkEv:3q2qF0Es0m4gsqbl+dt/7ixr
TLSH
T1B2035B52F140C863FE0B64347860EE2A573DBD508DA089C37356C35D5BF9BA3B62C29A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\vcruntime140.dll
Size 74KB
SHA256 cfa696cc292c932289ce013e249ca7a35ff7feea45eb3670de5607c035ab29cc
MD5 37b547bee5cecf64cdecf5ca3c1c6edd
SHA1 4c826136835c874c269d1fc00315fffb2838cc31
SHA512 591e888cb1c16a0a11db14c4b5232683aad42fe42d8b561aad7ae2eb7a4aee0ea8349703d2e794fd4cb81e54e3209b4c35339e3b28d7de46170a52ce31a57d10
SSDEEP 1536:lY2886xv555et/MCsjw0BuRK3jteo3ecbA2W86J/7qxn:lY28V55At/zqw+Iq9ecbA2W88/G
TLSH
T1D373AE22B0C140BEC56A857962B7AA12577EA9204FE5CFD77FD849444F78AC2F730263
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\verify.dll
Size 48KB
SHA256 5d42a25fa005fad5df96e5120950ee16542f6ebd92f13a2ae879b10cf907e4d4
MD5 40fa9024ba48de4957210e8790820ef8
SHA1 226331d6208d128d2d007c8e4d84f568b1a66a6c
SHA512 4deddb50be0942e53a627ae0a39642fbe74abe1c6af9dd8b7d179988f41fb399a6ad3d3cff56e1d9bfa6296effe8c825d4899331ace1f50149deaefa898b866f
SSDEEP 1536:GgCm8ISh3jzKnjlC/yM6E7KK4lS2b4u/7GNxKO:ZxIda8/17F4lS2b4u/XO
TLSH
T170236C82D9F901BEDA9BC43131E5A33DCBB4BD4126D0C583AFA28A81CF11751BB6517A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\bin\zip.dll
Size 82KB
SHA256 4e7f19108ed67bcb5f17dff3391e07e67ee6c26d06c39e7ffce7bdeabd3b4495
MD5 22db831430d272dc50823b9c0bdb030b
SHA1 1a1f9f7b711a1fadb6247d30a3d8c00bf4615f0f
SHA512 6a2d5cfef6b078e1fa2231e5ba22cac2c36ccd315fa74d5da65da8dd543658973d09519a36b0f76fbe66639b4f1be92b479384bf66d5e84e1a8cd43c79bd05d2
SSDEEP 1536:8ggsS6Ic6Sij15GlepSkLPWIOQIOm8QPd6Qp0C/7uxw:JQi0cepB4Gm8Q16Qp/
TLSH
T1A783AF92B9A197D3EFB9153190E6EB3D933FB51008804E93938DA741185B722AF727CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

accessibility.properties

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\accessibility.properties
Size 149B
SHA256 68ef2f3c6d7636e39c6626ed1bd700e3a6b796c25a9e5feca4533abfacd61cdf
MD5 2ed483df31645d3d00c625c00c1e5a14
SHA1 27c9b302d2d47aae04fc1f4ef9127a2835a77853
SHA512 4bf6d06f2ceaf070df4bd734370def74a6dd545fd40efd64a948e1422470ef39e37a4909feeb8f0731d5badb3dd9086e96dace6bdca7bbd3078e8383b16894da
TLSH
T174C02B03F08E17B95C0C18FB01DCD4C0B38049CFC029530F54E6213A6781C38008846F
MD5 SHA1 SHA512 TLSH

Submit Download

currency.data

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\currency.data
Size 4KB
SHA256 8cbed7c71c51e38ef2df7d6b5941384c1c691d9cf84de5039eb36cce7b57ed08
MD5 10fcc6f8a55d9c540d8ecf0d4eaa20c7
SHA1 5ec5ed05b691703a383e89cdb80fa141840825b5
SHA512 68747b3154e2838c88aa6d41f532f54078db73cc636d5adf48471b54a10bf0bf6e97a8185129ea52b23b6bc5d1a226e71de5ebdf7ef72a3c4ec3fc32c547a84a
SSDEEP 48:MlWAFFGFSupi9VBjOtF8CSh8kkC6/wU4XRr/bVdxe+0fBJ:MlWAEi9VBjOtzSh8kk0/pdTkr
TLSH
T1C28157036A659B67E85F1731DCCA52A4B933CC014B47C617A994BA2D3BFA3E06BC24C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

access-bridge-32.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\access-bridge-32.jar
Size 192KB
SHA256 96e52f5b260e3bc317aa10cf0ca3aab9cf26f6dfca94a082a4b4a248ac596699
MD5 0cef205aa47e371586dde79aa218a432
SHA1 51970aa2fd07628a55ac5cc82cdf439271f7f545
SHA512 e40493ff4579c152005aa1492dae0541f573dab99e4a4e616e07a724219641e24f0fea72eb5ac8f7b3e3f4da2cac8c41dfd78ddd2398a329c2b22f514226f6fa
SSDEEP 3072:cr4sKgNOqbK89Qlbyt6FTVChqkvB+JtmbQ/XPuI8c2nfwq/rzSTKXufysnRlq2:DQSHcMcvBWtmE//BInfJzzNcRb
TLSH
T15D146B03BE4DC8ABFA4782B25092EE567D086E7CD162437F4CD91B482651D075B32BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cldrdata.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\cldrdata.jar
Size 3.7MB
SHA256 721dc099d2faca39c4e378255a77b60329f87effcd49c2fec8933e9c48474224
MD5 a43c80cc8d3b4edcd942a0466a6dd66f
SHA1 2a78eaf6c0420c3cd3944b1f8c52566a1ec249ea
SHA512 c408b7365464ae4004c1324029f70ab63f1332dc27430697ae92e7b07495d6ebf4b6e97c70153e5e2486c8ac728945578f6f0f9fd3e66e7769da289a2f8128b9
SSDEEP 98304:/UZ5YZWFqWirgy8PmWH+NxVdE6rgOkTTxlFZd9dDYAi:csWfi0y+56fbrk3/TVVi
TLSH
T102060262BDE54833E373B5F10429D503A905C158E099A287C6E58E853EF4BC39786FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jfxrt.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\jfxrt.jar
Size 8.6MB
SHA256 a48b6f919dfd144456d4c01feee9e0ef83f73768cf3b00aff2734d90e8b28811
MD5 5a90415219a512f9622ea547a1ddcfe7
SHA1 a07126e8db63a8977c118b2b2ef46f490a577cd5
SHA512 796e18fd17643b537ac1cd958fb98b932418c897a661e8d11296b76008c8ac77afc11ee7c70ee4fa6a600031b80965951dd30df516006e62d4e06bb467c100f0
SSDEEP 98304:dNtEDUkPkRoX0nfl6PFbVmbrYbIDkNP8xTKZlbDV9ZdhilWHqWMhIi96EEgSupPY:b8FkSEnfl6tJzbJJ+T2JqWHqU/gLPnW1
TLSH
T10196E023B6FF9828ED6382F7BAD25B43796DA1BCD01610B514EC1D87A475C1E8F32225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

localedata.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\localedata.jar
Size 1.1MB
SHA256 3f8b673d8bd20cb2a5fc4b11bfbf1d74bde3bd529639d5cd0235ac5a85798e4e
MD5 e7a0a5173e35595286366d7f64d55307
SHA1 61c4c87f44211e5b47aeafa8f28aeeadaaa40977
SHA512 7d1d5f6703a0d7ed6e221ce46e2e4049ee490a1a7ae7da92a587cd148bea430a6d6842a86763908948db069248399a420214ce4eba399bade1adbeafc066fe21
SSDEEP 24576:zn8CYmx/07E/OLWxnj2MT0RPbdrvz4OxL:zn8CYCQDqT0RPbdrhxL
TLSH
T13D45F126BEC29576D373A4F10805C213A508C198F8ADC11B87B84C8E79F9F975786FE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\meta-index
Size 779B
SHA256 a455613323a0a6c5c5b7a409e6dc0b998005e020b7235a19993dcadddd55239a
MD5 e671b56c5fd624be6588d4759800a836
SHA1 6cf46f863af0a5dcaf32e839666956f34f847cbb
SHA512 c83e1b652c68bb89414f39dc53e5342b1ca04917388568ed6b6ddcf51474acc2af11664f5381cba091673a51afb42d0700bbc11ba2a50689d5423fc5e0df344d
TLSH
T17D01891F86479026A6BC8ACED837E341624CD11E1011C2BE45C629CA3D89ADA2A3CF38
MD5 SHA1 SHA512 TLSH

Submit Download

nashorn.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\nashorn.jar
Size 1.9MB
SHA256 8d14f9eb114bb4ab1f08ba81e3150fcdd71746cc54d5ea8cf8c67b420f7c355a
MD5 d64e4aacea031a6e58291380fa4ce168
SHA1 50497fe52efe37fa8ed99ee94bc8868154a06c3b
SHA512 2dcbf2d8136d1f861d4ffb96e744b19760fed06ee5ed9abd3a5bf6dd606b435da1c84e76058b210697e665d2b42fe7c80b170e01803d88f13d7c0bdd3921347d
SSDEEP 49152:8VqAhii74U4RiMoNf6pwoc+ro2Pvkda0bqlvYaWZTCzH:8VqAUUVZApwarogc802aaWcH
TLSH
T1C695D1233FA2F539E363413248A29151A92914CF91D6D09B0DFC0799D8F3EC99729BDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\sunec.jar
Size 38KB
SHA256 41fc083db18ef90fa63942ba1afefb41ada2bdbf4d8b2a7a99f516b3cfb64021
MD5 14a5e65f4fc0c01e27c1a4e92814882c
SHA1 42a1d982018ad31721f18070d12e6886b44f7393
SHA512 f919398c52886d6a4e96a22a8bd3779d0645605f25dd1247ca954c3a85f90b79f6e9ca182aa34beacb2aeff44131d50c7c44ec5042f6def1e2752a88c33f45c5
SSDEEP 768:6VsF4d20hrM6i3lqRksMq/gn4SlKJy1SRcVwt/g6gQaaQytn63zQHstxvhjo2I35:6nd20hQ62YRksM5NqyE+wtg6gQaaPl20
TLSH
T13E03BF247CDC047EF18745BB502AC58B3E16608AC95A93BB01D0453AF81CA37A77B7E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunjce_provider.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\sunjce_provider.jar
Size 270KB
SHA256 613c2ce3352eab7657eb887d1e004a70d04c3e2243ae7c5ea6a76a0dc83ba7f9
MD5 fedae0b75adc57e8d336d328e5119ad6
SHA1 ef47dd4f814768febc7d6c2e8b802e6274a4d9ba
SHA512 50fa298d597f3710cbb72791cac1e75dc765358436e8fe427dd95140e3627b2ccd90c0162a13e83a183f710a0f1833c28cce340c2ceda0ccc719ec5cd74d715d
SSDEEP 6144:dy0e9yweCSfUEOj0alFE/EDeZVTRZJS7xwbpvOkxl:d29hTSfUzQalFccerJS7aUkD
TLSH
T13E44BF277D6EE838DF8B84B53471C919FE0964F4E10AB26B07D108A074A5E43AF167ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\ext\sunmscapi.jar
Size 43KB
SHA256 9bdc7c351b3bc03787a05b2f0967e0bc8191d914b1be1a1b13bf80973b892424
MD5 d001157e0fe31966c22e9d3a90599d50
SHA1 f017f94a6b806dd782bb3bb21bb148103ccd685d
SHA512 b132660ffcbc57cd72daa04196ca77a988b1f904adde246782ac9341ed1ee9c30735680f9f91d6ff82795b52555c3390d6e3c95d755ac024255587a2fea3dc16
SSDEEP 768:hZP9h46ZHdd/ddyl9AMw2EctYPSRPXSRcfKddzH7UTWbzP/vLhZ1GYK0gDtAlQvq:hZ1h46Vdd/ddyHfw2EX4SWfKHbUoj/vX
TLSH
T14A13BE67AD2CC0A8F107457BC022917B3B9C4CD9CCE6522B5B51C54EF61EAA78311BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.cfg

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\i386\jvm.cfg
Size 41B
SHA256 c98e70bf81f14656eaf7b37323a33e5c4ba3fe5988a8c4669030d29223a5d3d3
MD5 47d92b7e08c05a96722f32407680811f
SHA1 c8f5e1a4456abdef4c473283db0853123a7c49bd
SHA512 7e4f9548a8243053972fa8819c9dedd3456c59494e8cefa06c1c9591dfb3434ab48674756b5837ade107b1b34d931ac6cd3aae7b585a0ec6ad8f4675ed0677f8
MD5 SHA1 SHA512

Submit Download

invalid32x32.gif

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\images\cursors\invalid32x32.gif
Size 153B
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37
TLSH
T100C08C88F34888828A4AD2384874138C68A4C4BB8A224B88144A2A94A2935A2C1D0302
MD5 SHA1 SHA512 TLSH

Submit Download

jce.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\jce.jar
Size 94KB
SHA256 92a8e861dda4691e1b436603e9e757647ddf3cd0deaeac1ca57a0d2f58a6173d
MD5 1d9a66903b52cd864a6bf9629d9a7539
SHA1 9795e0e2fee70862404920366a5dc80366702a2b
SHA512 e6c7357e5882f1e34f563dad40dfc64bf61dd394fc16c0ec5126d356ba735cc821e09461347feecdfe5c53895b9805c6b9110ed142fdba2441608b9975d7d19e
SSDEEP 1536:A2weNOC2BV2bycAySDuJLht6se6sVs/67T9g5z/VC8U0w/EX70a01rOvJMFKPzFW:/j2BV2YuJLXGVswgNVCTna0VaZCK4
TLSH
T13F93D0287D8DED65EF93D03A6970C83BB80E6098E206930747A584E5A4B4FD4FE03BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jfr.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\jfr.jar
Size 868KB
SHA256 6c8c5f54cd1957c1fe602438d782496ed6130eda328be7652ba2619a70e17a67
MD5 bcdb4e5b6b01c62699ca4f3dfc78ba6f
SHA1 cdd5df908ed3f68422f628ed2df2d38bfbc445a6
SHA512 3d5f56dba92996212474e4ef007e3e5427d5759a71ee2337200d3621c1584a8f39fbca60749253809931bb2d426c35924b3f7e312040ad7bfaa312281ffcbfda
SSDEEP 6144:QtQyu8hdNx0q14ZjV4NFQ1yVNwCS1SOUfebLZ5X0CLXaPDUwWnWfBoIuDTYF8x9h:czdgqxQU7S1Afi+r0UF3Q
TLSH
T1A415D617F0061E53F281EBBA1961072422B0E0F24187E951AF7E9D566DE31CBCE59BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsse.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\jsse.jar
Size 1.8MB
SHA256 439c6ca830cb80f54e62679b8aba7e6bc026e99d7a6a23cbc6affa5e05d1238f
MD5 ff133d48f7596ea2053bd10bb878957f
SHA1 eee7d2334e42feccbc6c7347b0c724d28a496f61
SHA512 53fbffd6c3492f36b5bc358de764df43eeda908f74371e23b87bea804610ba861a63f690f770d1ef255c86d34f62f1ea59eff672c6c8e41aa0a16a6dd8c28151
SSDEEP 12288:Z91HThiRg8oUxd3YX8uQrB4c14w3jtIqbyQtxOzR:tzhinDoXc1tZjtIqvtxOd
TLSH
T1FD959217E10C99BFF250DAFFEC70422833349C325D63B3394A49491AF5DA6B15A78AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\logging.properties
Size 2KB
SHA256 ce1688fe641099954572ea856953035b5188e2ca228705001368250337b9b232
MD5 809c50033f825eff7fc70419aaf30317
SHA1 89da8094484891f9ec1fa40c6c8b61f94c5869d0
SHA512 c5aa71ad9e1d17472644eb43146edf87caa7bccf0a39e102e31e6c081cd017e01b39645f55ee87f4ea3556376f7cad3953ce3f3301b4b3af265b7b4357b67a5c
TLSH
T17F510E6E9B4E2D35430A00AA9E6FF5967E2898BC1C23E5B6B39E6304310D43885D77C2
MD5 SHA1 SHA512 TLSH

Submit Download

meta-index

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\meta-index
Size 1KB
SHA256 dff270e76bd7d851cbcf79702aebd71122c3a9e93836ae4e9f650234a754b5c3
MD5 83964354d8e8e69dfc1001f01682bd70
SHA1 1f2012a464683ccc1c284d51b20778811641b2ee
SHA512 4be6e0c8ed2bd2f59286bbfa5041676f352e32731e070d7c26511e1e570bd8d6940ff2cc59b0e1656c9c8b3f86186a34709dbf19c303d80840307dacc39d9956
TLSH
T10441496B0287842F5E9849CBB977DB9647E8843618D863FD43E45C8179CDD4B0738A74
MD5 SHA1 SHA512 TLSH

Submit Download

resources.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\resources.jar
Size 3.4MB
SHA256 c3423129020dad555991fe94d377252457e66f51a91ec32731df2f5a05578935
MD5 722f65ef767a9ff96cfbb0bf42d17e54
SHA1 69d6d8d61c6e38362e30c4e769509057b9408444
SHA512 52033fb58cdc8f746f1055b473a0ec25e23d5a23dd70559cbf9c0c38aaa44dd0bc1ad5424dbf5d3eb7d1715d6449683ab984e995b494d3e3427690c77a93dfa7
SSDEEP 49152:L4Qj9Im+IR27arBwldI4MqBXRs72x87TH14kDktuPjYl4utRTgxXSl9BWeHIhF5S:CKlxK
TLSH
T197F55B6FB902112BCAB340B6EC3326C7E96019B183A2D627F1EC9F663F8485D5767354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\security\java.security
Size 54KB
SHA256 0c1bb675372d13aebfbea5fd83e746cc551b4ae320143d704d721a794d3de158
MD5 45b48241738f41108f8396a29eb9be09
SHA1 e841f0f3710b6e5b15bf373d7a0e4c80f15e890f
SHA512 1ace30cd2cc2f061048d712a587d655834ed69ab550eba74bb7bbd34a44dbda94b7d8bc679d8ae998f87b4d94dc5049500faf3727d996188c1f47a5f59099301
SSDEEP 768:Y8obod6U3O5O9Wgw2+JuN2gQ01pdYRE0G+fqtWHo69QZW93jfGgqcNhXLJ4TP1zg:Y2pD2RG+fqtWI1Ze6hczKTP1KkJwF/
TLSH
T131431923FB4A3B7005C21193655E83EDAB2C617B22725598769D8A1CB707C71C33B6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

US_export_policy.jar

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\security\policy\limited\US_export_policy.jar
Size 619B
SHA256 0730059503e4870be86dda87ebcfd9c63bcdb3ad7b2c4bd698701bafca77fabd
MD5 5c282f9afdda24faff6c2add58567e40
SHA1 3fe1cd7c61077ff58fe889608b9948dcf5198f56
SHA512 e8f6edf3e1cfb5b6fa34eba26a9190cf79d57d348c68064d9cb1dfbd8c3233c8da7466d07f7d3cc4ed547082f6b0c646a7036e24714813ec97e41ba117072355
TLSH
T12AF02479AFD5D805D3DA623007D38306AA1A241C731C57CB9D45A6601968F811F5BEDA
MD5 SHA1 SHA512 TLSH

Submit Download

tzdb.dat

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\tzdb.dat
Size 101KB
SHA256 6c086fad0eb35fa1e404b8e201b40ad647137e02d898e023fad85bf556b5df58
MD5 5be1059530b493405a669dfb4f687994
SHA1 a581bb3d718f3b806843e683102978ba1a97af6c
SHA512 7d76038d2f400c41c88eaa9984249bd83dc78fa6c00079d2661fd6061c47922fb7003363f944861627c817018e9ecaa8c7129b322e514e6e76ae009369e3b205
SSDEEP 1536:c0E7mtCPqMqfOoIlRi98yafvYoj/////ZC3L6Erf9h9tOWa5DhziwRi:cRPqXtIkvafvYoweErf9a5Dh+yi
TLSH
T178A3A2757F7150B7B2CF8222262B5B93097DAD416FC3080678B4AD4E8A76AD7603335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Users\Admin\AppData\Roaming\Notarius\certifio-manager\jre\lib\tzmappings
Size 9KB
SHA256 83755efbcb24476f61b7b57bcf54707161678431347e5de2d7b894d022a0089a
MD5 62bc9fa21191d34f1db3ed7ad5106efa
SHA1 750cc36b35487d6054e039469039aece3a0cc9e9
SHA512 af0ddb1bc2e9838b8f37dc196d26024126ac989f5b632cb2a8efdc29fbce289b4d0bac587fe23f17dfb6905ceada8d07b18508db78f226b15b15900738f581a3
SSDEEP 192:qwfOC9OYOxUmHomjgDwlZ+TFXsq2H+aUHCHQj4SV0l2:qqgniTyq06a2
TLSH
T19C120F017260A6CAC5B3AC0F3B467397F416B2D81CC19B6C3A2BC76B5D059B652E1A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher_log.txt

Path C:\Users\Admin\AppData\Roaming\Notarius\log\certifio-manager\launcher_log.txt
Size 56B
SHA256 d81417bbfde5b3b68008e8d1d7fdcde4ee0d69b9c478358aece507ed0a8f247a
MD5 9f737792a5bb3a1beaad0b4ef5d2e923
SHA1 dd0f25852b62d83d67143e2c33cdf2bbbe3606bb
SHA512 da92b4bc030c8f64b357648da13d30c47f547fa968ff19aed86b3945aadbc74fd277ed71631142a52b6744fdea84a769edd66767a2425f42a51194fdacdb0ff0
TLSH
T1AE90021112DC9A5EAC17815316F19A4840654B836B85655B8AE0595C6A41A55B445016
MD5 SHA1 SHA512 TLSH

Submit Download

launcher_log.txt

Path C:\Users\Admin\AppData\Roaming\Notarius\log\certifio-manager\launcher_log.txt
Size 5KB
SHA256 83d6868219a88be2a445bbd9a4d6806fdebbf40cf321dafcf54c5e2bc278900a
MD5 b1568b5b47182c4a25e8a2db610648f5
SHA1 68ed6f87b6fac8be1f9ecfe04707bd4ddbc0ef2f
SHA512 27152aa7efd35c1d1696e07e42568aaf5a6afc31b48706f6fb33fc788ae9736fc62a72af8867c016b3056c653a462ef5b11c00bee60ae8212912c99b19cd2815
SSDEEP 96:oHXL/DGXcnHXXWwSBwnwVwWwUFY7JDOwSO9mL/DGXcnHXZ:oACJDGpP
TLSH
T16CB1224BD02D0E922FB600EBF0744A0953E24A6AE97811D7E75C290B63DCF8D9B1764F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UALJNI_32.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\native\UALJNI_32.dll
Size 76KB
SHA256 6abd2209c1535d1bbbb073a9f73fc6810e8a981b2104f9c51ead0cbf4cd3aff0
MD5 3be9c2de8846636a76a0ab4b5e829154
SHA1 c19ffe177c75518b89566d1665308981b99a9e74
SHA512 dedac915ecc8446af749ba7a1f1d90b91fb2b234b03642e3d7e7bdb1219bb421ca43338ead2bfb149fb1f118a56764b0ef4492769d71502c16c187585a915275
SSDEEP 1536:eYbFlqYLRoQOGPJbfGJIAu+zLPHUGaVeBjuvI:BFlqYLR1O0duT03OjuQ
TLSH
T1D1737C2076D0C177E0662A349875C7625A7E7C32AAF4C48BBF8817B95F703C1EA39356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jnicapi_32.dll

Path C:\Users\Admin\AppData\Roaming\Notarius\native\jnicapi_32.dll
Size 70KB
SHA256 f1162f1d7017cb8ec1fef6e56754f516db8e53309bd93f900bcfa55489c5c825
MD5 c599999e068247d33c8172c69883b3e7
SHA1 df4a081113c5b22b83cfd216cb0cf709442ca9f3
SHA512 889cbc163b1e2b33d554b4a2716ecbef7e0179226aa7c53629fb23d72ea1a12b5110be5ecdfdab27d06782d9f85fa4f6b486a0618c761cef52e9b7cd74695328
SSDEEP 1536:Xn7zPm5rexRBzhikMCImkzjyLUXedkbIQ:Xnve5rMDGyQXedkJ
TLSH
T1A9636C11B2F0C472E0822C342874D6719A2DBC62ADF49D8B7FC607B95FE57A2463A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acl_issuers

Path C:\Users\Admin\AppData\Roaming\consigno-api\acl\acl_issuers
Size 39KB
SHA256 e8823e0e6db0ece573df089d244de119c3caccd2ba557559554ac90a467c7bc8
MD5 35382d3ad9f822ecbfdefc3e40edff08
SHA1 e4ee570881d5df9f5f29de6eca784ea8bd05aeb5
SHA512 64b4d9b1d37e8a3fca2a2d2504dedbc094849310a9674f9e321555eff0882d0ff9988980ea1522cee5907d88e57ba4355fdba30d9e4a6ce9c0f8feaef349a324
SSDEEP 768:Y712iRatj5dmITh7gdjYGMf30nw7zsbk5Pza0hQjdH69u:Y712EcYdGfK2kkV5O5a9u
TLSH
T1FF03F19F7E53ED748210B8102BF94D466B18339DD6A2795D9D72A3F0914BAEB089333C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6675b79bdaada94e12c67a9c737be09171ef21f

Path C:\Users\Admin\AppData\Roaming\consigno-api\acl\b6675b79bdaada94e12c67a9c737be09171ef21f
Size 2KB
SHA256 6db9c7e858b6588b1519f72804387e692018fae4b02c6e2b7518acee95cdd367
MD5 64cdec2df43705af5300a2785ab43197
SHA1 39e7346ba374215549f7f8ef6c9b405236afeccb
SHA512 5debec3f59a059f636c3f9e7275c5ec197b92ed52ecf31505ece1c2ac5ea0ebf9246789d9e81c97d80548165911f587a679bccf148887a9f2b9e74217dda8e38
TLSH
T16C411AA9C66B22162A7CE7CDFDF1D30D720E93D7690C31AF0D5BC090F866895956CA32
MD5 SHA1 SHA512 TLSH

Submit Download

ecawin64-11.0.15.exe.crdownload

Path C:\Users\Admin\Downloads\ecawin64-11.0.15.exe.crdownload
Size 16.5MB
SHA256 dad0770d843441221f6b6f8df3c0efa907600a32de02eea332a6256f0b962c28
MD5 001e11f676417b88a3e2839c27bab564
SHA1 88d105df88830bb4033466a16a666950c0a13024
SHA512 94164c2ab68625d312339f9ed9f6eab7c076d3201f007b7603b044a67de15fce324c740e04ef39244898e84c745b8e7e2ec5e95095b1a809e5ebec4b9bd6adcd
SSDEEP 393216:Jl2dW8CEyHtIecXY0K//0euR8cY/i5WENb9fnJGO:JlHKyHt5cXdaDu2cUaP3BGO
TLSH
T1B007336EFF5080C6E94653392B0B166FA2ADCDB3D9F08558BF383E948BB60B3445C945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8935.tmp

Path C:\Windows\Installer\MSI8935.tmp
Size 1.0MB
SHA256 7797a45a0ca4e5ffc8fe79673fb656ca1076d47968df9637cca5b1a589d0a1d1
MD5 168b0d460d77afed7414f0ebb44a6378
SHA1 b046260f7d65571518f0773a289005dc09187e62
SHA512 c36e4689c2e74a4dda863e286be0e58e01531dc46f619765a6e59364a1d20fdfd85cd1bef6f4d14d9b26a556c665f50f914768bac227e445dd12c4aeea5b8c91
SSDEEP 12288:o1LomGFa3ZyTyqdjVtKNVKD0Kph6xeGFxGL5GhhfG+/9M8hAkloDCMxiQCn8Eohx:V8NXloxjCn8Ek0u3SqWgzRB
TLSH
T1BF259F16739402B4E0A7E178C99B8F46E6F278464331A7CB07F456AA2F177B15A3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIB66C.tmp

Path C:\Windows\Installer\MSIB66C.tmp
Size 202KB
SHA256 e0db1804cf53ed4819ed70cb35c67680ce1a77573efded86e6dac81010ce55e7
MD5 d773d9bd091e712df7560f576da53de8
SHA1 165cfbdce1811883360112441f7237b287cf0691
SHA512 15a956090f8756a6bfdbe191fda36739b1107eada62c6cd3058218beb417bdbd2ea82be9b055f7f6eb8017394b330daff2e9824dbc9c4f137bead8e2ac0574cd
SSDEEP 3072:r65Z1YCHGiZXOVneG/kdvLdzusAatnw1lflQnB+QDO1Q+cxbVeFT:r657r+0G/kvzoaBcHLnN
TLSH
T10C148C216494903EE7FA1936D93ED671AE7DF6280B60C99EC3848C0E5D604D16BF3B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5b78c6.msi

Path C:\Windows\Installer\e5b78c6.msi
Size 26.7MB
SHA256 7e5e0d80c88e75fe190a8b6bff5ef568f524cb0ce34b33d552f3cecb729df024
MD5 8e79bc5402d68e089a332e1a746ded2c
SHA1 99d6e40fd0c5fb34638f9fad7543fcab9de05885
SHA512 c8ce1ef6ca1f7521dfeb919f3f234e8a37c1e85e26a0512a1a82368673a40abf92324a0dde42351cefa2ed7668c57c7681e0506112a666ffa2edf6810d1429cc
SSDEEP 196608:RE1XrlBpIRTnH75/OMK7n9Ib+ktqPKsyMuk40U3x0lEldXvhtJ2OH:RE1blBGH7c30rtcUkqBMeXvhx
TLSH
T1F457187036082955C22F83F79E4899AD416AED90C3C7D18612ACF5F6E97B0BCE728D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

transform_en.mst

Path C:\Windows\Installer\{E8729790-A8CF-46A0-837A-320280A73C1E}\transform_en.mst
Size 5.7MB
SHA256 16843f0ce548678da9dd987e940ebc579ea302612d9be09e34d8d607e19ad752
MD5 bddf1748e39ef3933722c7c09b401555
SHA1 a6da6c2deb2f1ac928080c93c707b3e170693a4d
SHA512 f42e6ae4974df0aec83e58b215cf0d200b43bc3688f3bc9efd9a17f21d279f85abe97952b816a2471aa18f292d5b1f28c25ceea5eab2a8548b83c17df6b8b88d
SSDEEP 98304:+K9EdVcv6m90kFoAbqqDNo9K6ZtTCweLx:J9WVxm9hJbq1HlCweLx
TLSH
T1FE567D21B5E0CA26F7E6A731DD7B27649EFABC98D834CA0E424840AC1C75F509536B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-333-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-269-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-361-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-1402-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-334-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-1403-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-1401-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-1146-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-370-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-357-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-262-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-256-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-934-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-949-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-1190-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-981-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-582-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1284-1000-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/1336-440-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1149-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1390-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1379-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1380-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1360-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1361-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1356-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1302-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1304-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1299-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1292-0x0000000025740000-0x0000000025756000-memory.dmp

Download

memory/1336-1296-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1287-0x00000000217B0000-0x00000000217C7000-memory.dmp

Download

memory/1336-1256-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1255-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1249-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1244-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1243-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1232-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1227-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1217-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1182-0x0000000021690000-0x00000000216AD000-memory.dmp

Download

memory/1336-1163-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1164-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1159-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-1147-0x0000000021590000-0x00000000215A6000-memory.dmp

Download

memory/1336-1441-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-959-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-257-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-865-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-839-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-784-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-722-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-710-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-663-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-503-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-274-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-514-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-321-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-523-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-506-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-442-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-438-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-389-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1336-391-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/1388-3460-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download

memory/1388-926-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download

memory/1388-201-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download

memory/1388-198-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download

memory/1388-196-0x00000000002D0000-0x0000000000332000-memory.dmp

Download

memory/1388-195-0x00007FFA31B5F000-0x00007FFA31B60000-memory.dmp

Download

memory/4356-3468-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download

memory/4356-265-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download

memory/4356-255-0x00007FFA319D0000-0x00007FFA32374000-memory.dmp

Download