89a11725dfa82fe7ba56952e4593e851343ed2dc12b323d727040bd9ca2ed7ca

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
Size 828KB
Sample260825-18vxrawyby
SHA256 89a11725dfa82fe7ba56952e4593e851343ed2dc12b323d727040bd9ca2ed7ca
MD5 bbb5f60692e2a24904acc2ce8745937b
SHA1 a0a42cd860d5b05309d9b65954f8faef42f7b7f0
SHA512 4bb4076136fc63a8a64bf317159b4851336d967d35dedca1c62a62af036fbac233123ceb69de5d98dd673bfd839951fc41ec6a84d16526961c2842208d055eae
SSDEEP 24576:2CSMa1yKSHx73c82R7VpWBPnmyjHBldthWFu0W:gPBUx73c1UBfmaHB3Ou0W
TLSH
T13E050117E21B50FED88BC4B58707A422BA61FC4D8760ADDF17949F712A72ED06739B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
50	372	msedge.exe

Executes dropped EXE 22 IoCs

pid	Process
3712	alg.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
5072	fxssvc.exe
2896	elevation_service.exe
3112	elevation_service.exe
2392	maintenanceservice.exe
3784	msdtc.exe
1940	OSE.EXE
4948	PerceptionSimulationService.exe
4192	perfhost.exe
4792	locator.exe
4176	SensorDataService.exe
60	snmptrap.exe
1148	spectrum.exe
1856	ssh-agent.exe
536	TieringEngineService.exe
3588	AgentService.exe
1720	vds.exe
3868	vssvc.exe
4668	wbengine.exe
640	WmiApSrv.exe
3472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f6caac2f79c0b0e8.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1664_245495833\nav_config.json	msedge.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1664_245495833\manifest.json	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1664_307661614\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86734\javaws.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
372	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007534efdcdf34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c398b3dcdf34dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004f20dcdcdf34dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cd0ecdcdf34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca0eaadcdf34dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7d2cddcdf34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EE3C33AB-B5D6-4E5C-B0D9-E79ADB264680}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
3012	DiagnosticsHub.StandardCollector.Service.exe
5644	msedge.exe
5644	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1376	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
Token: SeAuditPrivilege	5072	fxssvc.exe
Token: SeRestorePrivilege	536	TieringEngineService.exe
Token: SeManageVolumePrivilege	536	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3588	AgentService.exe
Token: SeBackupPrivilege	3868	vssvc.exe
Token: SeRestorePrivilege	3868	vssvc.exe
Token: SeAuditPrivilege	3868	vssvc.exe
Token: SeBackupPrivilege	4668	wbengine.exe
Token: SeRestorePrivilege	4668	wbengine.exe
Token: SeSecurityPrivilege	4668	wbengine.exe
Token: 33	3472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3472	SearchIndexer.exe
Token: SeDebugPrivilege	3712	alg.exe
Token: SeDebugPrivilege	3712	alg.exe
Token: SeDebugPrivilege	3712	alg.exe
Token: SeDebugPrivilege	3012	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 3644	3472	SearchIndexer.exe	112
PID 3472 wrote to memory of 4776	3472	SearchIndexer.exe	113
PID 1376 wrote to memory of 1664	1376	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe	116
PID 1664 wrote to memory of 2912	1664	msedge.exe	117
PID 1664 wrote to memory of 372	1664	msedge.exe	118
PID 1664 wrote to memory of 2852	1664	msedge.exe	119
PID 1664 wrote to memory of 412	1664	msedge.exe	120
PID 1664 wrote to memory of 2852	1664	msedge.exe	119
PID 1664 wrote to memory of 412	1664	msedge.exe	120
PID 1664 wrote to memory of 412	1664	msedge.exe	120
PID 1664 wrote to memory of 5176	1664	msedge.exe	121
PID 1664 wrote to memory of 5184	1664	msedge.exe	122
PID 1664 wrote to memory of 5176	1664	msedge.exe	121
PID 1664 wrote to memory of 5176	1664	msedge.exe	121
PID 1664 wrote to memory of 5184	1664	msedge.exe	122
PID 1664 wrote to memory of 5184	1664	msedge.exe	122
PID 1664 wrote to memory of 5344	1664	msedge.exe	124
PID 1664 wrote to memory of 5336	1664	msedge.exe	123
PID 1664 wrote to memory of 5344	1664	msedge.exe	124
PID 1664 wrote to memory of 5344	1664	msedge.exe	124
PID 1664 wrote to memory of 5336	1664	msedge.exe	123
PID 1664 wrote to memory of 5336	1664	msedge.exe	123
PID 1664 wrote to memory of 5520	1664	msedge.exe	125
PID 1664 wrote to memory of 5528	1664	msedge.exe	126
PID 1664 wrote to memory of 5520	1664	msedge.exe	125
PID 1664 wrote to memory of 5528	1664	msedge.exe	126
PID 1664 wrote to memory of 5656	1664	msedge.exe	127
PID 1664 wrote to memory of 5656	1664	msedge.exe	127
PID 1664 wrote to memory of 5776	1664	msedge.exe	128
PID 1664 wrote to memory of 5776	1664	msedge.exe	128
PID 1664 wrote to memory of 2356	1664	msedge.exe	132
PID 1664 wrote to memory of 4796	1664	msedge.exe	133
PID 1664 wrote to memory of 2940	1664	msedge.exe	134
PID 1664 wrote to memory of 4796	1664	msedge.exe	133
PID 1664 wrote to memory of 2940	1664	msedge.exe	134
PID 1664 wrote to memory of 2940	1664	msedge.exe	134
PID 1664 wrote to memory of 5464	1664	msedge.exe	136
PID 1664 wrote to memory of 1440	1664	msedge.exe	140
PID 1664 wrote to memory of 4700	1664	msedge.exe	141
PID 1664 wrote to memory of 1440	1664	msedge.exe	140
PID 1664 wrote to memory of 4700	1664	msedge.exe	141
PID 1664 wrote to memory of 3716	1664	msedge.exe	143
PID 1664 wrote to memory of 1784	1664	msedge.exe	142
PID 1664 wrote to memory of 3716	1664	msedge.exe	143
PID 1664 wrote to memory of 1784	1664	msedge.exe	142
PID 1664 wrote to memory of 5852	1664	msedge.exe	145
PID 1664 wrote to memory of 5852	1664	msedge.exe	145
PID 1664 wrote to memory of 3772	1664	msedge.exe	152
PID 1664 wrote to memory of 6084	1664	msedge.exe	153
PID 1664 wrote to memory of 5456	1664	msedge.exe	154
PID 1664 wrote to memory of 3048	1664	msedge.exe	155
PID 1664 wrote to memory of 3048	1664	msedge.exe	155
PID 1664 wrote to memory of 1220	1664	msedge.exe	156
PID 1664 wrote to memory of 1220	1664	msedge.exe	156
PID 3472 wrote to memory of 3112	3472	SearchIndexer.exe	157
PID 1664 wrote to memory of 552	1664	msedge.exe	159
PID 1664 wrote to memory of 552	1664	msedge.exe	159
PID 1664 wrote to memory of 3312	1664	msedge.exe	160
PID 1664 wrote to memory of 3312	1664	msedge.exe	160
PID 1664 wrote to memory of 1216	1664	msedge.exe	161
PID 1664 wrote to memory of 1216	1664	msedge.exe	161
PID 1664 wrote to memory of 5644	1664	msedge.exe	162
PID 1664 wrote to memory of 2972	1664	msedge.exe	163
PID 1664 wrote to memory of 2972	1664	msedge.exe	163

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/vs/17/release/vc_redist.x64.exe
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e8,0x7ffe091ec188,0x7ffe091ec194,0x7ffe091ec1a0
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,17023695045759620011,91620625163993005,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,4937853381373843966,9278942466050792052,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
    3⤵
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,15887206339489734780,7956410816703988,262144 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
    3⤵
    PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17072889155091773111,3468631348450236527,2097152 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,9529074772547303608,10117440068126463269,2097152 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:5184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,14964889538060480302,8732228936459486293,2097152 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,2825748823326050009,9111246918633233668,2097152 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:2
    3⤵
    PID:5344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,4671808886006264856,3437921356337871647,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,1695524944241489905,10025701705292912154,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:5528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,14054830689551693425,13660454643386916081,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,15533235966617284932,12439699796745231263,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16189313366137386567,8844346219677224272,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,16189313366137386567,8844346219677224272,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,8312003124163299424,8910362263811195699,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6328,i,7895184299085033979,14091033224775400374,2097152 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,11467759843155436050,7376992603940070088,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,9743480599408340061,1213035478788037466,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:1440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,3853019764680874608,10308347409790186273,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,3576280138984777543,2948478406652356950,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,17118870810215197249,16281095578052165939,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,9860990064481543168,12882402005287988116,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,698241957629874457,9392386100808088321,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,14551574952485404395,18077493442991575743,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,10569660382700373304,8362013850193258067,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,6677455525240873846,10606579724341092637,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,6534083878107070878,17127795886606751516,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,377693575202005384,16175274376645823056,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,726351267788354119,9463294230289600879,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:8
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,11969616652452147164,3209212878287278382,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:8
    3⤵
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6416,i,18433044568569276644,13500388602308845029,262144 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,8162877714662280322,8672919994632827978,524288 --field-trial-handle=2620,i,15650885974178287513,14707347996678548974,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
    3⤵
    PID:2972

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2900

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2392

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1940

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4192

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4176

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:60

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1148

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1052

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3644
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  - Modifies data under HKEY_USERS
  PID:4776
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-668679576-120646659-2289335452-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-668679576-120646659-2289335452-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2bc361ca603373d43ae2e1af75bf65599bdcc68baf31e2c880971007f74b6453
MD5 5e2fe05837021f8e7f25cb39db77579f
SHA1 8407071124092222ac9362fbc521cdab25d816ec
SHA512 02345c306799ee7ef79c3e10ea065888fa5af5c68b9ab9e5ef8708d5a72e940d9ae5f3072d93b3abe0223c9fa86dd3a7ce8003251a90d9819cf32bd75ef7b05e
SSDEEP 49152:Gb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnA73c1UBfmaHB3Ou0W:43q6sjBb73fVmah3Ou0
TLSH
T1D9D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 95fbe690876125bd64c769cb09365b8b9df9f1e2baa0e33c1cbc92ac4f1a198f
MD5 2b5f2b49cbfbf2f770018809657893f6
SHA1 f771b46bda55b9f6208bbb6e47d822aa96dd1249
SHA512 c92932c611d972e9d39836743d58fdb99e4dc210ee231a3cb561313d29fb2c4c9b73e5df0d5aa2ee6eb69a1cf8e7ba10275f5995fee08a48f6d9b03211a46247
SSDEEP 24576:+XYfDtczAn73c82R7VpWBPnmyjHBldthWFu0W:dtc673c1UBfmaHB3Ou0W
TLSH
T19605012873A409F9EC57817CCD628511E632BC964360E7DF03E49A6A1F336D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1f0a935aacd416f13f025613fec7f7f4444923ef4535f3e3d9994215d6d3b026
MD5 5021158965feb8c910d85e3f6d224907
SHA1 f1c1712a3d80ef371dfd0d5b4fe33ab24ce890ad
SHA512 268c144019f5d015de8faecd0504eed13708076c0164f9a3f595d4f066effaeb4f11ce4b61ca7b5be8313ab41272f9622196899f8dcb200740b4be927dc0f466
SSDEEP 24576:H0Le5ji0hmxxrMY73c82R7VpWBPnmyjHBldthWFu0W:HPji0Ajd73c1UBfmaHB3Ou0W
TLSH
T177359E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 41c3fb65a594cf6d86f13c54b9542cc07421c1dbfed2fe70ea298e72ad7d6c8d
MD5 91a2be67b8637369c48280a78df3fdea
SHA1 02276e3381d1ddf52de1d591946133d4aa8bf678
SHA512 6116e2a8d3d29ae60e2f1b5efdf18249baa0120fd4af712b1511056dcde75359890885dca8756a461519bf5dfe8b1e187fc256f565166cce63b0ddec96aa8868
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWn6q8wyuK73c82R7VpWBPnmyjHBldthWFu0W:I/ezSC6vUzPveHjyZ73c1UBfmaHB3Oud
TLSH
T18F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 80ca20d11af737b16690596fb0ff7e54013c4a9847186e3d515c20a632cc92ec
MD5 e9425fbabdc41528b92094a47af83803
SHA1 80cfd962764cbac0ea7773167485b5b53ea25c18
SHA512 f23c3cd6d648b341334701ea4a4c478e841a13a03510b660869546a0343828bd446fba3178bf223940e8a283f38850f29a1f22367adfa22dc9d5cb93e0f448db
SSDEEP 24576:KVbqPb88hv/l+Yr73c82R7VpWBPnmyjHBldthWFu0W:KVO88hXl+S73c1UBfmaHB3Ou0W
TLSH
T15F559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 fabf3f1693fbbf0511859cc340d955906f627805eef882db6a313634fd20caf5
MD5 8eccc764bb4d785875ba473edd7b370f
SHA1 acfbf9241237f5a92489eff193158422c608db37
SHA512 a109d2c12e2c6fb99609655a56ea48b20ce129d2294de9a86cb402cc6b9da61a73a668207285c18a9b45711805663e04e0a312ae57a8d091295d10f1e0d15164
SSDEEP 12288:rLcjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:rLc73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T11DC4230266281231EF0AA0B0DA171612F154ECDFC0960F9F959D7BEE277CC94A9C7DC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5631955eaea85d2178af429a509dc7ed2ab9dfb811a86f5d569c3ac8c65bf2f7
MD5 4d3ad43cc052067a8b2aaa88cf3c33b1
SHA1 d4534347a6e2eec4a176054e62ea159c30633099
SHA512 aa4745dbbd17e5833bd3dc38adc816d7f5eac3e9584152076bb6a85c39141f849f959c3deaec22c5b027a4f0c11a562a4a7809a1c797445eaec03511af6f1b25
SSDEEP 24576:9JIUj73c82R7VpWBPnmyjHBldthWFu0W:9JIUj73c1UBfmaHB3Ou0W
TLSH
T18605CF3BEE28FCE2C67A8CB85B518600E77278714B5293CBD165830EDE235E05E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c76f8b4849fad3ec76f155732c7f547e44e8507d6877fcdfec53b98b45c34598
MD5 72277621ac0eb584126a084900816a6a
SHA1 29cc925d8fb39099b05e215de716a267b1a513f3
SHA512 b1531702b0499ab703411cb5eccbf2caf395508bdc477b497c40aa9f3eb3cc60253a7f1e781593349e907a1e4eede1bec22a1427c890eeec607592d2456a1b14
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:8QvGAdlCEL8c/DRNw5Ca73fVmah3Ou0
TLSH
T1E8266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2825ac994ea4adb23cc30c262680291cc3ce9ee23f0f6ee963756c216b2f53f0
MD5 63b02f1431288c7339225e18777a399b
SHA1 3315cd17800b4fddddbc01d2a5b379f38c6f6bc4
SHA512 5d7ebcef03a95cb926450d1f6f3efba596b98ac76f8f0cefb1cf6d793359827647f195ee5464ab3f6873bd2d0fabb2a86779b8f0318da1e7360bc90530c12d31
SSDEEP 24576:10ewsAjt73c82R7VpWBPnmyjHBldthWFu0W:Oljt73c1UBfmaHB3Ou0W
TLSH
T12B15E031FE74E032C67F0CB21B26C716542CB9604B621AC7E3E89E9E59346D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9b1c809c41926493f2199fcdb82bd978d83b8a4de54e0ae6eaed8247252f02d8
MD5 828dfa1133834a3a626a95c51b1f1b39
SHA1 a81eda2e6957ee3a0b78a6ee0d7b59f706b74437
SHA512 37ad6b75c6b54074ec46649fa52ac56f8dca44b36036f68272967ab722ac78ca987ce0c01d36cf7dd289fa8f19f0c5f8bb60cfd5ce1610787f94b962dbb49632
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHBfVNh370:KUEtQevvqc2W1cpV2tI32Rl4
TLSH
T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 595c01cfe4b56079fc6b2d886fbeb3d79a4e37c379c8a1189cf9ea4817e94052
MD5 16a2ad03296d5a600b7918b24975b903
SHA1 0a697eab8cb2c7126f5f5144c35a882fe5b8508a
SHA512 65e9187558637dd16be5236c2ced8ad97a45b25ab176eebb567503df3597cc32191c1a38237cba0618dc6f9368d2375b99a482ecc73774f8a357ea904ccfa944
SSDEEP 49152:SCbRquA/m2yL5zifFiV+XenmE3/zN73c1UBfmaHB3Ou0W:3oqHVjnmW73fVmah3Ou0
TLSH
T1D8D58D0976B8C2E4D1F6C37886A2C647F37178154B3597EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8fc5954b71b39241af1bc0b09916cc8237e80723615f0e42d44ea43afd5f94ba
MD5 779b9f442401bc048830deec1a9dbf9a
SHA1 d6773d42707892c39344c9986965700544d756be
SHA512 d9acfd9ce9e87f5704b974ef0c3de7403ed61aa771a49f2f6c631dea6b320e1bd8ab0cfa08ac3bf139f4aa685b7836a6da2b626922034a9723ef3d25d441e9df
SSDEEP 24576:3AhGL3IFoiwtA5l7S53273c82R7VpWBPnmyjHBldthWFu0W:3AMUFoiq5m73c1UBfmaHB3Ou0W
TLSH
T12C35AE81E7F955D4F5B3AAB899768171EA76BCAA5E31C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 d05fedee0873981f45bd8656b50807ba486938ca53906f876fcf582a94a4ff9a
MD5 31f1ff3e23393279f577772ce2b76a7b
SHA1 d5f6632cc764fb42ed8d6b9265c830ff03dc43c5
SHA512 d7633273288558832ae565ab7c520b5181fca4a0995414fa7a4082de2b2427b63fc535e40f6f753d223f07ee09040084fe89d2542c6c3535016b1574da090a47
SSDEEP 24576:Zwu4OW573c82R7VpWBPnmyjHBldthWFu0W:ZwvOC73c1UBfmaHB3Ou0W
TLSH
T17005F14672A40CF9E9679138C6578132F3F2BC462A25CB1F1760C75B6F37661AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 0f8e4a848b4cd158050e5d293d5abe1c732320a7b9268f4d5156bb11092e3fc5
MD5 efbb65fc09620718cd9ae430fec4ed40
SHA1 6e874dd83a5d713152602fa3f91a6820d9a7ce5c
SHA512 2f3693cea16cd347f3c72baaa9ed9bc70c17a634f2adc6d77c573bbf4f0f4197ea7de6cb9ff5c26feebb14aa784cc014bddede6ac47d9fb99247caaac381c654
SSDEEP 12288:teZ1Iy9jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:IZuQ73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1F6E4120A33A421F5E9479178CDA24601E371FCAB537643CF126957AA2F37ED12D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e62c632752c0a63ea9452e04764515939dae825d2d1fba0777a8b4c1cd2c5f7c
MD5 0b8f3b20db49a1f22caf9ff5a9bad4d4
SHA1 e985039fca7263501a79791c2544daac579696e8
SHA512 10fee8f10f8f09767bc14983e3b175e4647f06610e22cc99115d4dd9b2bad743da2f5432e4ef428b7c0a5c1109f7e212ce45bdf475e394e8f09a0d5c4b655550
SSDEEP 98304:QQRQyi36YOcPbLvw2gAf+PN3f73fVmah3Ou0:HQyiKa/X+PNzfVNh370
TLSH
T15C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4dabab98677d5124eb45ceee1798f068f2b18e92510e31933dc106004e1702b8
MD5 94d879612de47fbe6ad37e517ac3c46b
SHA1 8515992ba280188d0864efa3ae0566d5d5711fac
SHA512 9ae0adb1d8ff9f699cf9a216e93d967830b8acf13f52a0aca7addc3a6fb660551c311f7a29aaa5cb66e9984bc057007d558e1c00d31abdb8854bd9fb4a66d45d
SSDEEP 98304:mQRQyi36YOcPbLvw2gAf+PN3f73fVmah3Ou0:NQyiKa/X+PNzfVNh370
TLSH
T158667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9a66f17121e51f0aba793e207372ed2f4bf7485ab1fc375960301769337a1e1c
MD5 7362047e43f80020df4f3fdab7bc6066
SHA1 1fb36d254c54c1d8b0ce5de71116a6489519d83d
SHA512 edcf4605eafe4bf72d50d1f79c993e19728d38000904c32323b43a204fa3c4b18d3e6f9d9188a66f3b000c79abdf6fc449bb69999b2d08861efbbaa10f14eadc
SSDEEP 49152:f68Qg55nhceWu7PNU3/d73c1UBfmaHB3Ou0W:ZthLRc/d73fVmah3Ou0
TLSH
T177B55933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8505720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6c3aca2aa1b8df9099489954e495e5e49baf8fc19af88f7e3ae8110c34a87b68
MD5 5f157a61c818f2f1c05a801dee2e4408
SHA1 ccc07ee91fba8f8bd0d5b90ffbfaa5198e2e68d4
SHA512 55a22041a0a699ff6c6508e646cdfeb81c9018c11e69581a5d54ad4885be38cd12b58b7c0b9175f8323a9fb6a4ffc1318517777834fa69b304716811334ee916
SSDEEP 98304:qy5112gYy5azzVvt69nLKnhZc73fVmah3Ou0:TLIHEWh4fVNh370
TLSH
T1CA168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dd3f37fbf4f40a2ae5fa12d0e9a12fa5c43c860cb19fbffe09360a8427227559
MD5 a531fa19f4d8a7bebad366decd8968d9
SHA1 cbc069c612b87bc943dba079949dd24a2e3fa096
SHA512 bb4b2429e25404b876bab77af39d7677f3282e173385310f7139a817226129657ee06ff3dedbf1a785774b7fc4f7a706022f30b3a5596a0dc87257fb8821c76e
SSDEEP 49152:PB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glX73c1UBfmaHB3Ou0W:xu6Jmdxd2dX73fVmah3Ou0
TLSH
T1A7D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2fa8e31c71844ea393e4b5c936605081766f0031f9b61ebfb581d4b329436c8b
MD5 c691857e89b1035c58dd070964d13116
SHA1 221b37a69082e916cab8c1c2082432c347fab15f
SHA512 8fa9c94a32d0716843e64e40382b8384930b74ccf6ce0cb6fd85d64e37c6878cc76a21aa49567ef9450dc17a23b996bbbba2254b5074d775e3f13c416e9c8e1f
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xD73c1UBfmaHB3Ou0W:smifPWRW73fVmah3Ou0
TLSH
T113B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bf8099d3e3fcdd71abe7360af061c727afe3fcfe4fba7f28139ca1db3d2e9682
MD5 d2ad9095216fcf06fc7c079535949387
SHA1 0df2574f07c3b4fd4155bef7bf5d3b3c20034237
SHA512 b2abe629c6877996adf6cc6b866b292b35079b6c434ea6365192c7fa932d392f753f21483e98b7a7ba47d7a337564f046a36fa31a8a23e33911305d240967066
SSDEEP 49152:mSuZQIY0Be2KcRVtOnks6NMHqQ73c1UBfmaHB3Ou0W:o5dKii61Q73fVmah3Ou0
TLSH
T19BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3ed534e375b597fffae102feaa9da6be3576b8edd75164ea06c18bc90a865c8d
MD5 013e265f922e393f62c246a81befb42e
SHA1 7ae3c6aea131ec2058556872253fdc65ee972662
SHA512 98064b841d69627a6b0f6a5c504d06e5bc783230ba1ebc8d18956ce81f8462285ae7dc217d4f0ed34d9a3a22357fd4516319c9bba34aa17d05b72226f79d486c
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wn73c1UBfmaHB3Ou0W:UX2imphi73fVmah3Ou0
TLSH
T1FA95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 e479aa2db2b3e35eba3f5c4f0235c0db1526279e2d00b75af07cd1f207fc81a8
MD5 c39a753e3d6339ac10a05c878519daea
SHA1 d537a33f8ce5aa28692adbf9be951200212a4e0a
SHA512 2fc6389e6e592162a2542bff6e0d79325ba0befd8a8c9084bc57fb00ff4262b4e0f29c5510dc2f28cc70635e286f9c5501da215b1e1fcfa5d96aea6b9d009aaa
SSDEEP 12288:wUjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:wU73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T13FC4230675290332ED06E0B0CA171201E158ECDFD19707AFB69E77AA27B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 89d03a723a0720997e307d9ffec19b88e854e1c3d58b11f7976889e4867c117e
MD5 00edfd975cf6a607dcf99a2e1f676a44
SHA1 e4c4dd66795bd1d13a3d37c827097da49b9f7864
SHA512 3e17a17702d3e5b1d58c5b63a6e4eb1b1dcc85188313e14aaedb91e0bab182915fcd84fe481878d2d3044548105a1880b40e572cbdc1425095073d5b90afff78
SSDEEP 12288:dBjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:dB73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1B9C4231675290332ED06E0B0CA171201E154ECDFD09707EFB69E77AA27B9CA529CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4c83e819f2d7d0e8a4d6b490465fb63132fee5361318e94d224863e684de1234
MD5 5169b47c41855fd82f20d802c0486f53
SHA1 41ec991963fc94879dfaf8f110f92454c20d42d5
SHA512 d35940e93437c123d143bd18005c750bd8a60cdab8e69725f72e2b0620abe6358d3830cc2bb482f619eb8e3323bf48c7aa7abbf040f7001cb6f14a8acf85934e
SSDEEP 12288:Ebjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Eb73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T168C4231675290232ED06E0B1CA171211E154ECDFD0970BEFB68E77AA37B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 5f5a9d60cc22d5bd4c3cefc95ddad3e208fa2898a01a2bd288a7209087a868d2
MD5 6593a5970ff1ba6b8b9c56dc74f802b5
SHA1 a30c33b0208bd2b590dbda9653dd964b14e003ab
SHA512 ba32c8d752013f22fcbc2ad295395bdb516eafc0af568b822c95c2bdd157dde85de631e7ff32ce6ed702af426ffccec0a1cce87be56d5f8fc384451347b6fde3
SSDEEP 12288:xVWjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:K73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T10BD42306366902A1EC06D0B4CA134211F2B4FCDFD27347EFA64927AA1F75ED42D96F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 741ba4207645aa5c4eebc551d75f585f08d5e4df05978ff0fd58d115d37a4f91
MD5 1989db4f05fa68160de99598b6451110
SHA1 674c7032e897915a1c122644bdd45ae566d98ecf
SHA512 d7a9c524133000876b801e03381543d5c280fc342f28a294887131aac7adf954b146f0df59474bc60724bb83235199d2feef921447f1f49f46898122221f1aee
SSDEEP 12288:5+jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:5+73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T11FC4231675290232ED06E0B1CA171311E154ECDFD09707EFB68E77AA27B9CA429CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9ed50208d6a600280f5425f9d519fa162a34664ee88fdb63e9da40eb3a6d753d
MD5 65c1ac78886b14438cb23f62f49f41ff
SHA1 22c94448bbe717a2de35131c5cce6c545043b444
SHA512 c6bb18e75bad7308a09fdb45ee0e188bfe9d8cec9ace44e2a138ad0c76f58a9e11ef16b81831a83cb5d00a5e38d390401c4106da20fda9760338f3b93f3d17c7
SSDEEP 12288:uljvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:ul73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T11DC4231675290332ED06E0B0CA171201E154EDDFD09707AFB68E77AA37B9CA529CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 4c55a602e4526dced083866ce5db1a1c9a65cd54bce8f546335a7505149899ea
MD5 3d2108003c68d989e42da7dc9e3aacfa
SHA1 242822c704a5ee42cb061cd79d40291243e0262b
SHA512 0124ad8db34f8b9f3563f6f56d7ac33c1aba8cae082805851f26cf2d568f1e7ac8b6635e0a93dc08cbad1bea40929c7c389cd24b3c35c94939546302c14bca19
SSDEEP 12288:rpjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:rp73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T17AC4231675290332ED06E0B0CA071611E154ECDFD09707AFB69E77AA37B9CA429CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 14c00549cac1c5235333a0cd565392cd8fc90424ce117d068d60257e4d4b4555
MD5 335e794d508967689aa4d6b53b7baca9
SHA1 8b8ec9364457a1323eaad527f6db3452dd5afa40
SHA512 b22a65f0fd81af8483b1d0a3855cd4fc65454419fd177da2f2fe6fd1ccfa794bf88b98ded7c2387ff9767a450a54cc4c6f47e90d83897c17d04c764bd3173da2
SSDEEP 24576:uZMRzFVSOh73c82R7VpWBPnmyjHBldthWFu0W:uZMRzf173c1UBfmaHB3Ou0W
TLSH
T1BE050195B36018F4EC67813ECD168906E2B2BC5A4770C65F13A8366B1F337A11D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 34fe6f30d4dee673f5ea7a50f13310d3ea7d7817c983b91db425be81ed871671
MD5 d98e624bc9b83bea8d0affec7a7c5c0b
SHA1 0f6e825a3741e1a1e1aaf92b58200962608cd85b
SHA512 12d834b446256a02824f0fff9befb362c07293ae42414a95a134f3bf357983d059b68d3935303bd2c328efb377eb61d43a2fcd07407594841422bcc86bf488d1
SSDEEP 12288:egjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:eg73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T157C4231675290232ED06A0B0CA071711E158ECDFD09707EFB68E77AA37B9C9529CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5f976c965dd2038665afacc1b72b0aa951f0e47d7cb4a4309839cab651ef3b32
MD5 6a75fb0cebd0303853a5ab1a2c6d6dfd
SHA1 1243fff8a2a379c97e510a6f6f4c063094a64df2
SHA512 3363b3c09b93f2b50cf11aad50d46a6cd753e8af5771763869f2addfe3951185c1b92214dff26b255e303c0cd9ed3c55412df560c9f2a329e14ed1d0f51ff91b
SSDEEP 12288:hsjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:hs73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1F8C4231675290332ED06A0B0CA071601E158EDDFD09707EFB68E77AA37B9C9529CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 ee93d246f8c90fdf1419526ef62693d3e56e704e0055b79c4b43063e4c1f7d04
MD5 5f217d6f2032c3bf9b680d4bda1813f8
SHA1 5bd3cb324bcea2215ee998e21c94aff34dc8de64
SHA512 ed2f3ce4200b37c4f398bf8d145e273b6028fed07f660bf07ca5e49244b3fcb8e0f8f5122746fd0a77ebf97dc415c750b1feda12aa4ec06dff2065a9f3064f64
SSDEEP 12288:eyPz5L89jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Dzy973c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1F6F4020773A521F9D5269134C9520A02F371FC7B47218BAF53A8177A2F37AD06E6BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 df516f33d9445ea7c94b4966d48017a8f0d4e4d378b553d2b1f18dd98ffa3d6c
MD5 1607977f1e880dc7fc8f8392ca81776c
SHA1 cb03de3c795652bfb95e240d5a22c65eb8b74f2d
SHA512 236b2a9051f5b7abf40e7894e040695d625b668fb0844bcf882be849bf96c8dec639fe1fa372474ebec44eace20c9e39b3b8530a2cc9cad8494e57ebdd43d0ea
SSDEEP 12288:Egjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Eg73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1EFC4231675290232ED06A0B0CA071711E158ECDFD09707EFB68E77AA37B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6b7fa80b999747f39e17316eedf3c5e7d927346ddf7a1ee2a2011c6d46f10783
MD5 24add09265d5165b0841758124f25548
SHA1 5cf527e7e59c220ab1ae45dc06e75b5d8d50a02a
SHA512 4cd4b48f54eaccaa51dc880abca79a05e7678c42312ebf546c5c75e1b422feb31228bb9759221af564c28a9f18b5e210608c5d2536f4cf749b452b2073fbe1e1
SSDEEP 12288:Egjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Eg73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T144C4231675290232ED06A0B0CA071711E158ECDFD09707EFB68E77AA37B9C9529CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 d03a7337ba2c1f693d487d18bf1dce420276273e1e4cd126cfc34dcd9dc89520
MD5 4b7d623a9fe2193214f1fd257c21ec9e
SHA1 271e1404da603b52c79b227a2bb8ccf0341be88f
SHA512 09ef1c61eedfce1a67c2c091d012f547b3b2a5f43462f6014f97435859eff6032b59028adbd56a761d990d482c3b58e40df85c9a3022e9c66867354cf61b3482
SSDEEP 12288:gyPz5L89jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Rzy973c82R7VpWBPnmyjHBldthWFu0W
TLSH
T18CF4120773A521F9D5269134C9520A02F371FC7B47218BAF53A8177A2F37AD06E6BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 f39d3d9754c97a2140c741dfc251dc28a607c47cde494f82a968947d185734d6
MD5 f9388fe3e12a0605d6f6416fba38ab4b
SHA1 58a404903f1c92658cbb4095602b0d790f7a6a22
SHA512 5c828d9ba77f5efad6b89c5cc86f9cd5e4839c477918662a5dab31c3528bcb2e5de4629e911e3da9a298d5b54da8206d94fac21325a854094e68e0f1e5889aff
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71SNKbrh/8KBI73c82R7VpWBPnmyjHBldthWFu0W:CP4m4IpOO67N8Ka73c1UBfmaHB3Ou0W
TLSH
T14D65AE2DABDC0096D0BA917485658A4AFAB1B42E1F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1664_177269450\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1664_245495833\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1664_307661614\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1664_716428523\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 616ee573043be9b169f62c33275628206d56d5bebcc02e022d289f2e42bcdfcc
MD5 4950ecbc44ef3e589fc77d9810aaf7fd
SHA1 7227b404967df1bc79fc5d77d5e1744ced683f53
SHA512 57e08cfb13ec0c478192df7d4d42af4dba6e36421a49017a2dd2fd749117e9314b01a18520a8aa6051ce5e215c4364a1c68c371085a3a11852ecffb4c2a72de0
SSDEEP 12288:mbsfQjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:NQ73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1C6E4F11AD25802E4D45EA175CB164601F333BCAA83E283CF62D4F67E1F769905DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 912bcf14ca5e369fa075ee0edac3169215722421956fd79cf98ade151f9a9e4c
MD5 07b8973c12ed2b312e693875b1038b4b
SHA1 2b9713547875fac06ef5d213582e0cb04c0f541e
SHA512 7f0dcfc4f8a66feb4020dff8c9e277e4b35c76dcb01f6ccf66c8b6d140ffa2a1160de648bdaddad4176de70c28f362d17c011391164d6f332729e581626d787f
TLSH
T1A8E07DD506D8C3BFF642E44BD26C474C82A03A0AD3C8AD9AB7008C84F482048B2C3FF0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7280bf4a56dae41c4230dcfe775dcc5cc0e7c03fa0109900ed2a31c20b9ab637
MD5 781f846a28a70cedf5e3e3f2f998f069
SHA1 2aa3cd8a5377e0e7559c1f11871e122695ba5aa1
SHA512 2e3df08a4dbe65ac8086357e09111aa79ed3e532526e21a2b1ac9ad94abdabc9627cbc249ff32f9a21ee3b6753416dcafc28e8092494e50b7a6b3057fd16dba1
TLSH
T1828140B8024312AEE77D52319ED21E3C747382E8F9235F5B51A4D8B1ED957A3D2364C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d6a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d6a4.TMP
Size 3KB
SHA256 5476fb6bcf740e744dcd0cccfe7b5c3cd407a9eabc35bfcf5cca16af515deba7
MD5 e6122d790b60f94317f49b992904aced
SHA1 665b82b4414c11307486c14c7e7dc217b8cf7a63
SHA512 8adab3eba13157b7d7998ac0f52a701574e91553efad9e5d089d844b80a006da8c5b681f449f1490fd205bd5ca691ffc6babae356d23dbc4a433b199bd891ed9
TLSH
T1F58160B8024312AEE77D52319ED20E3C747382E8F8235F5B51A4D8B1ED95793C236484
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 336e96e9dfed6de89789ab55ec32daa8822530addfe93a416b37873614d86863
MD5 ce957c835890347ed33090df955f6859
SHA1 9d08dfaf9282b9b95df0df7adb3fa4a56f91447c
SHA512 404e8371e252ac490d9205dff70770986116e3cf725383983a3ab3de7d3e0957c3f3549a1f40d70179f5646ccdf2ac1fbb4e256d8dee0d4a559d4a4570357c6b
TLSH
T15631AEF3C6E8857E9A4152F0BB287E1BCE2D0914432C3D9AC4E4AF1B93E28B1E14055E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7842a40d9ccebb6706d7066f3e29bbd026cb5bb8bee394ff67f2d85f4869f895
MD5 d238a6fd0f07b0ccc1eebf3e935c2181
SHA1 f0e8a42a5de5174020435e66632f9ebaf28ac9ca
SHA512 0f1d326d94df6af26d7b77ef4b5730df60d801b32acdc24b3df627303709a35096442219ad4fa039bb899c21822ba46a6d447d42ef409fa36d0a0b8a29e89dca
SSDEEP 192:sxZilzuW/f3sqsvIEdpJHW6+WNGYCvrTfIgyJ:sxZiduW/f3sqsvfJHbG3zO
TLSH
T18E12A6516E38A53B8CCBE21DBB257F53E6F95032A1D01E58E6FC961C04E6ADD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e15803e8686a1cbbfc5893db114c57deb373c2e9e5a69d3f4cf1a5def6e85ec
MD5 73a6d268da7f0875c9ed171b8df8195b
SHA1 811170fe8286650a432607b36ff95aedf644ad2d
SHA512 e63d01b614d2e3ddcc449609b12d7f89fbd1ad510032a725c41970478439a7b98bd592c3d15759ff60f88e33cb8f45ba5e5a58352b9de46103d19623994eaab8
SSDEEP 192:sxZilzuW/f3sXsy+H+B7IdpLHW6+WNGYC5g3TfIg53J:sxZiduW/f3sXsyzGLHbGuz3
TLSH
T1DC32D9156E38A97B8CCBE21DFB15BF53D6F95033A1901E48E6FC861C05E6ADD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2d698cf529327147f3c8ab287b84e35460453982a7de1b3d9560c6805f0a56a7
MD5 9ffe7cef960810df8c765f50abeef3b0
SHA1 0a60cc81c7de2b59c2c65a1e02b94cb87da25207
SHA512 15e2bdbd20a99bf28ca499975a85fe09f67a10ca773ffa8187edae5cf0384137fe20f4f70b599a194995b84a449bdc251579a3e485077b9500a4d6a306d8b3fd
SSDEEP 192:sxZilzuW/f3sXsy+H+lIdpJHW6+WNGYCq33TfIg53J:sxZiduW/f3sXsyzWJHbG+z3
TLSH
T1F932D9116E38A97B8CCBE21DBB157F43E6F95033A1901E58E6FC861C05E6ADD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 db1b84ac67b67adb01a8567784909e4190654e16adbe91329ec2f5353313a7fe
MD5 4edd65c149e9ede271c4aeab4eb3097e
SHA1 afa2fdc9095c8a2ce44824aea32beda976e22101
SHA512 a96fd20ae839fa0f747cea922af23930996b52cb270473b4623e00417153a1c274c4a0b2d73effb679ac01681f4e04f5d6a39fa5eaef829520f3250ef401b4fc
SSDEEP 192:sxZilzuW/f3sXsv+H+lIdpJHW6+WNGYCIb3TfIg5ZJ:sxZiduW/f3sXsvzWJHbGazF
TLSH
T1AD32D9156E38A57B8CCBD21DFB25BF53D6F95032A1D01E58E6FC861C04E6ADD220B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1e733d8ada864c7e42709f9261c73426e19e5d2edb3c61e802498e42a7d8fd3c
MD5 16f5d76a90bd83e923bb6558063a9f3b
SHA1 3495082139b6db1db6d65f0a2d81be43cb54eb22
SHA512 e9ea46e89d16acedd4ec8e6300763cdccaa48559c76088785c2fdd7d570db3b2941462928587897ad70205d8f97ff11b6257423723b66cb5111a952c571dae7a
SSDEEP 768:lHqbUm+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVIZLlRTKrmroSD:lHqbUm+WvSCs6u1javZLbWrdU
TLSH
T1DFC2D83B340CCA7E4FC01E9DDD5A6F972E9802C76A588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 563a074c4a03974a457cce2143996cb5e61c02dfcdbe9384a4067819847e29a4
MD5 2236cf23ee96bf1d53b305b7d3896ce3
SHA1 a078c2147b62391d278cea7996733288a9aabd41
SHA512 1e4ade7f504a0c39a630ae029a544f5ba3f0f1c52eeb1dbd29df828ef9e08c511be19054980a49caa1a62dc421d78a9009dd47d511fa6a295aa52c1eba26cde9
SSDEEP 96:KlkdQ0uS+gyKHzssgK01s2gA8s3WEtGZiKCoC2baWQ44e2oFFA2eK4rA0eMe29Eg:2kdQ0uS+DKHQsI1s2r8s3WEtVTJTT
TLSH
T123B1915130FF070038BE260C96EAA5369E81B2673515A8BF3BB844B15F66E151CFCAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5960a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5960a4.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7057d0f8c09594d60cb3ac72ea507d060c4b112a983eaadc9b333ff43cb59f39
MD5 5ff70b06778626c1e92cf4e47c3cd535
SHA1 cbbc4cf56102a355d926da55e86099857db6b63c
SHA512 f685b9c1170ab65f3fe5c49abd2f21914a21825425a151fdf949a4f819cc9c035c4f89b28d83b1945fe040f8b48d1adf9a0fa6b2c893859b241bf858ae0d1abc
SSDEEP 384:nvZcIhsNMUE+ofMZYjEa+mOByuv++Wp9+HBbslpo8:nhIZYYabOAqxWXgApj
TLSH
T198827BB5683CDC7359FAA106F58B3A574EF850A789C96F90E5D89B1C00DA69C230FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ae3f324a4985f1c11764ee5a98db8b79f431f3c03ede9deca9b23aaf3ae4a6ee
MD5 33e725a5d354f5b20369094b99a260e5
SHA1 53ef6a1d2ac31048e4902059e3b55075ec3f4b0d
SHA512 cb5ed70279a487e9aedfe44cdb02b9da9a10b40774eb145b4ce142418f6a220a92a4986c8b0c0b1453490928acc0a8441770baf5cc9339f004080511b8a19cb0
SSDEEP 384:nbZcIhsNM7E+ofMZYjEa+mOByuv++Wp9+HBbslpo8:DhRZYYabOAqxWXgApj
TLSH
T166827BB5683CDCB359F99106F58B36574EF850A789C96F90E5D89B1C00DA69C230FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 21f04fd2ae5d2ab786db995eba066ae61b5e1318906d8b34273ba36796c9633f
MD5 9f0c3771ede38d8aee2c08932aa576e4
SHA1 30f9faeeea6765de6c0715bd2844e59e4e7204ac
SHA512 01306f822129bc4eec4cc4da4a070ad107bd35ff046f4e3715f62a460e966b8ee4a8693cc34a699bb1e7faad8955a493532c8a2312d9a6114537e049c294732d
SSDEEP 192:vONx6Db6QmiUyb+HBa+jqOmWtm7RgjIU6:vONx6uDHBa+mOBHMU6
TLSH
T1A302F93969786CB79EB2AE49F48737275FD4207BD9962F84DAD81F0C00D764C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 b29e4e7a0ff76d21607ff3bb1757d0203c7cdbc2ad10f8ecd0571e94968f61ee
MD5 b95a436ad35076468c4eb2c9e4fcfd7c
SHA1 7dcef6eead8fc3c2cd2febcac15b603a3b863452
SHA512 600c828a48100d24e5152d4a32565ecddaeb044b6565ea4c6f1e0b2348dce156341253feeacfb141ed5a80d4eaaaab032b732a4a0ee8b22224678fc84944b573
SSDEEP 384:nGiFiZcIUsNE8TUNTUlIlUE+ofMZYjaDf4xa+mOByuv++7p9+HBbslpo8:tFQUlwgqZY9xabOAqx7XgApj
TLSH
T16BB22976D8A8CE7BADF68786F74676879EE400A385C899D4DAC85E0C00876DD130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 edc0f6a494b8e492741d1e5fb8ce34978abc162345297f1e2d9571c19c8f50fb
MD5 3a9cb2db94ce584c94d0a81e88aa044c
SHA1 727c9ba7dd5072150416203c4bac466fb3476b1f
SHA512 e5678a078022d44f8d4b8ebe908c39c903e3d0a6f12e4646153c7f4f6154971f65109a9348cca9f02a591dcb1ac0bcb8bf7b68e2815df6af773e6d5850eee9f2
SSDEEP 192:uuoLsNMlQ9f+hbiAeQmiU1mScYs4Ea+jqOmWtmtuv++uamoqVl96G:nusNMlE+ofMBYjEa+mOByuv++Wp9V
TLSH
T17C422A74683C9C739DE6A549F14B37579FF810B788899F94EAD99F0C00DA69C230F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 64d4e13f72f0ab0b01cda4fe2fc7415a90ee9965cc0a77a3812f3af6830be363
MD5 57b435d7f1cb165e22caea627a678847
SHA1 488a9ae4a5b406ea6702271a3ca4d13a932494b0
SHA512 168c0cf35059f81c81b1efeaccb36df2d404d3eac7ef4cc433dbebe939673b13ca9692fd94a27b9fcd725b535d8a0c3d7aec5d116af40eee9e655f6f9ca50d2b
SSDEEP 192:YON96Db4QmiUyYZ+YxBa+jqOmWtmtuv++bNzoqVl9U6:YON96wtsYxBa+mOByuv++Vp9U6
TLSH
T19412F735643C9C635EE6A545F48B37A79E9820B7CC8AAF95E6D84F0C00D764C370F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

7d61d4ad-e3ce-4325-85b1-aa6ee4752127.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d61d4ad-e3ce-4325-85b1-aa6ee4752127.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d689ea80-48fd-452f-af85-246d5d409e29.tmp

Path C:\Users\Admin\AppData\Local\Temp\d689ea80-48fd-452f-af85-246d5d409e29.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e29ab144-238d-48c1-83e4-d6b9700f3b52.tmp

Path C:\Users\Admin\AppData\Local\Temp\e29ab144-238d-48c1-83e4-d6b9700f3b52.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_1506343904\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3d8ea4f-e5c8-42af-9e59-9040c066cc5c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_650985929\b3d8ea4f-e5c8-42af-9e59-9040c066cc5c.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe.crdownload

Path C:\Users\Admin\Downloads\VC_redist.x64.exe.crdownload
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 db1e9e576d9c2d1737ca72058377548f878f541b3abeef8fdc8e9a302bec103f
MD5 36099a6dcc26f9598ad8053add7b47fa
SHA1 e6369f05a9b960a29b98c517b3b228e4e8aed830
SHA512 88f06e6ea602cf0ed9b12b35f069e466f772738b20129180b1a1ecb69a05b71d6cf421e9b343ce72653832e68d4ae5ffa251d052a424d224b71151ae15369f57
SSDEEP 12288:Twjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Tw73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1B0D42316A36C1322FD0AA0B0CA174221B119FDEF8A5646DFF54D37AA2778CD42D87E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 60f9340d10420f4413d8439225748a6b53ac80e59ab57a86039f1aab0e1e5298
MD5 0e08ef126249086baa96961dc166799f
SHA1 7743dc23682cb0432affe29092c4f19fb82d5000
SHA512 a4cb808b0b752e18aca0b3cec3626413c4eacb5313243d0865dc2f706fdcdde391403199ce55a17030804cb85c2057d3f6ba2105cd545daa2213a56c4d9c4c75
SSDEEP 49152:ta0h2GEkuAe73q3pp46zwwQ+73c1UBfmaHB3Ou0W:ta0hNYG4JwV73fVmah3Ou0
TLSH
T1EB85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 7b2a7493572cab3b1e0a1f5c2d0826bd2bc81f37b1115e903cb66452554e220f
MD5 a51f715614555720fe44b8ace67ded47
SHA1 0dbf5c4de3e0e5c7bc6787d1cb1a59a9783209c9
SHA512 ab422c4e9647237029a34268ef49d70ab6d05a8ab9b698e4756d7b33cb9ec87d806f08492c5a5c838ee76b6705003ebe7445d8951514f79b2345b37d78e20bec
SSDEEP 12288:ohbHjfXxjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:ohbHjPx73c82R7VpWBPnmyjHBldthWF4
TLSH
T1DFE4023E26AC11A5F522E1BC86564606D330FC6A172253EF62C5927E1F3BDE41C7AF81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 46fffa2ceccd582513e098c1ae437784eebdee2fc62bb35759752724d7b60ea6
MD5 4eab33eb3cebaf17116d7ca68952a1bf
SHA1 cb952db428422234dd45dec84a4f8ede202b8b42
SHA512 4df6a887935d801c71c76218c51abd3c2e291c07112f43d024e0de2e420459476eb7b21b0caa112eef36f738d1a246db8323e18f47f54ecf19d1865fd56bf010
SSDEEP 24576:/3YgnJcRTk4yti+R5dpR/573c82R7VpWBPnmyjHBldthWFu0W:/IgnaTk46ppR/573c1UBfmaHB3Ou0W
TLSH
T10745BF2DF2B910B9D8A6D136850143B5FB71782E1F209ACB0174C638AF1AEE85E35F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 c045681d462d9d51080f272f557b41c08f220811447b0cca97ea561850a3c7ec
MD5 de22fb08f106756ece8df96296d3d55d
SHA1 3dd94c07e37b2eee0152b4e60454af432d28eff4
SHA512 8951ba8573a5eeac56621276f58275e50b8cccd412289842f7f046aff7a9912a9a12cac9001b0ce55a6c9b744d799e60ffb68be150b60c9ca21a20ec54ebf381
SSDEEP 12288:u8jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:u873c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1BDC4230562291222ED06E0F0CA074611F114FDDF83670BEFB59E77AA2779CE52997EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 352b75d7e5c2f9a565210bc23ec3e61d1e37f39bb726bf3c0c305e81da84e928
MD5 aaf9d9f5de84dc9cfb4f59d69eb3d0a8
SHA1 64c0d52028e12d08ea5086fab2fbf80d3cc3a868
SHA512 8b2f3a7558f9abfd3ed1ff171f9509040b40915d5186bd368184b023ad4bedaef9b339cfb2b5a5a5bfa88a515fb6b96c9e3251943bef6d7794a5767cf673e40f
SSDEEP 24576:ubL3UTn73c82R7VpWBPnmyjHBldthWFu0W:ubL3Uj73c1UBfmaHB3Ou0W
TLSH
T1F725F115F7A400F5ED6BD13CC9668612E272B89E0364E7DF03A84B661F636E14E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 aa93d1e359cc19d0f0689cc242390d3baa0d634c9147ab5ccce7bbb415443c74
MD5 4ceb8fec0022cb9c408c40702e543251
SHA1 7786246eb4179f2f12e0412f64bd476c5539a15b
SHA512 fd067beddd3a5502e1bc5b73d72fb2508a8c0e8745e5cdd100d637bea8f7197d94e5d4c871904d4d61d08f6fe0342cfcb9b7efccb56e1ab7f1f5a893503e546d
SSDEEP 12288:xpFtIODjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:QOD73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T153E4021932AC10E5E526A17CCA534309D371FCAA472247EF42D082BE1F77EE86C7AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cbedc829a7c60b0d69e2c2b40d38ffa96fce316629f4112366cd7231335a0698
MD5 003a329c9b54122630fe2d572d0a41ae
SHA1 42de27443f9736fcbdf518811b359fdba69a015a
SHA512 9f0d419cf19be9457cac98994e4fea7e0cf382d9622bf6fd2925464f17f61efb6d077726863d278e505b9689f714c89696a8ec09a2024d6ecaa82702f438622f
SSDEEP 24576:97NM9YmZqmWMUkPjZM48Mv6bEhsg73c82R7VpWBPnmyjHBldthWFu0W:97cBWMpPjN8DbEhR73c1UBfmaHB3Ou0W
TLSH
T1E165AE2E6BAC81E5D477D13DC9A28205F2B1B4651B318ACF5152833E7F37AE44E36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 0ca516d1e585002bd23f20ad555dc08af3c0319e247883c18a15969a793ded88
MD5 813b28e640075a745465a0476e90feff
SHA1 1df0d167c5378bcd8619ba374540fcc1011ea0ce
SHA512 f6cf099e0f2c8754a4c62a4c204685e0e9a9d50d2b248be51cee5260c1850d50bac2b8e69898e65af61797e676583f8b3f108d543db66ad9908c066af375e62f
SSDEEP 49152:8F2YuHNETovcvNYf8kmA73c1UBfmaHB3Ou0W:Z6tCf8kD73fVmah3Ou0
TLSH
T15D858E2927ED80A4E0BBD27D45B7D246FAB2B8551B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 14a87bf27ef9d1c92e629b5f27c5e624a616ed55e11b07fbe86ad28fe2b0e94e
MD5 931cf3205630e12244804675aee96a88
SHA1 5100a73a01cf5ff51d3b8170e199cd4305b6b602
SHA512 74d891bb962b08827850f4049c6f8d2cae12329b2ac9f19fe2649bf4ce0bbd1ebc4873618ed3b81d32e0712491f990cdaf0f15b9e2d9a3799e8cb0b3a7a9acd5
SSDEEP 24576:PAFs06+OmlfkNXEbTo/73c82R7VpWBPnmyjHBldthWFu0W:YFs060lwXue73c1UBfmaHB3Ou0W
TLSH
T12D65BF2F62AC00D5D07ED17D8A97C91AF2B1746707255ACF0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 f45766536a9da86e08e767e2b3c49bd58d67e770c51d5d8a024f32e4e894a6bc
MD5 81005161ebc7f168a010d7286110b95b
SHA1 8fc321360e38e5caf564e51d73464b69412b06f1
SHA512 24c200237971ce61da6a669aca1e9e3255207d9e308f9d4437f6fedeed57e0d18ac1414c3e8792ab866d67c2de46545838e2104240fba9049490046fc19fbd5a
SSDEEP 24576:tJnJ5D3Wte73c82R7VpWBPnmyjHBldthWFu0W:tJnJ5DGte73c1UBfmaHB3Ou0W
TLSH
T13615D02DD2A810F4D477C2B4815A1756FF72387D2B226ACB24B4D5353F22EE0A979F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2eb04685596eaab6578b5c0943a42ba6c3ae757453089c9a4c84908d73d00923
MD5 d526f13eb09d47b7398ebaaa6347ed17
SHA1 3ea33aea19adac39919f34718ce24fa5a047cbd8
SHA512 4a4d0cc34b9fa2cf7da3f13282199c66b8c1db90f2e04d09448ecae0fa0b21d890b45efbb2badb3de552539e7b74957de6241c16665324c6127bf16d77c7bd3c
SSDEEP 49152:vo06DIKdwc+eQnSt65aVU73c1UBfmaHB3Ou0W:Qy73fVmah3Ou0
TLSH
T103956C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 cb4be3492af2f6dd8b37938ff35752e71dcbc6ce3e374f2cea0a73399fa539b9
MD5 1300d26a81c9ee635e1cf38e15d4bd1a
SHA1 e49cce4b60a141bfbb40c1a95ab1c27cc49acc57
SHA512 b78cf19c89eb76a9a46c7c0d1b31b39370d72cdce02d6248bab22b6ab7dde6e74ecaf7daf73fd944846b60aaf8d8e038040835494170faf19a2d0c073c59c24d
SSDEEP 12288:QEP3Rrqjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:rrq73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T157E4122E27AC20A5E91AA07CC5528201E371F8BA575217EF52D5C27E0F77DE92D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 066b5a8f6f8eca11cdd0a44070892e7bb430c80ff3be68213a753a1bc35f6490
MD5 0e81c05893233cab7647c7d61b42c2a4
SHA1 c25a16dd7a950806296376b014286eb9b5c810d0
SHA512 165ed88faf25bc3722950ea5dd5e7c0650f16d50306832b702c3040f40ba5e8ba465b8b934dcd159001599461c30f83c31ab899a53e4cc3d408e72d974820403
SSDEEP 12288:ujkyBjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:uIyB73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T116F4120563A811A1EA6A5178CA234250E634FC769B2247EFA1C0F73E2F36FD46C76F45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 dff6aeb4396d82ce8f3dd768e6d0c1170eb3c554a85a9010f43f48c8dc13bd39
MD5 f6ee3ff1d85ced2e278c9d0853fe5e54
SHA1 804463ddb8660bf6443adeac66e0f797032a44d4
SHA512 697ecd0116252edf90a55ca0cb9f6bb906be87b02adb29c226362920715b923d8e18d61d3da93b5a437e9b221a831cdcac23f6156014455dc03dbbd5ef928817
SSDEEP 12288:UFTjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:ST73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T186D4231922292232ED0690B4C6170701E164FCFF83560AFF61DDB7BA6B79CD52997E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0c49b88496ec0734d72864b2a4d84d7ff34a2bc9e4526717d02b38dc03a9e47b
MD5 615413f380e35a8e7ca5097e76728936
SHA1 3695e279809392f31444a874a67e099d4d34e674
SHA512 33923c900f0fed16ed8ebc8cfeaebbd569b28be5136890e545c5d6470c5414640af5ca06123a5623670d8e47920d54acda670d11c6173b18c75351056437f04e
SSDEEP 24576:zQ9MxZKdcz97w3473c82R7VpWBPnmyjHBldthWFu0W:zVKX473c1UBfmaHB3Ou0W
TLSH
T1F4558C2DABE9059AE177D275D5A250C3A633B4311B31C6CF2448D03D4E7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 b91882ebc58a50a6fca846c7dccfad4aa29b1c7235a0cb285de35d42ef7875ef
MD5 89089157c883e843eb594643b4d7a6e3
SHA1 8ff3a05b108058c2ba6fb5c59076e5f37f978fe3
SHA512 2c3d0a91692e969fba23820eb9b63ab992d05bfdfb5a5751a868392212bd4959a38ac0a493551250392f8cbf17cb7e93731b75e353f4194d71d83f62d1c5bbf0
SSDEEP 24576:5yocxApt73c82R7VpWBPnmyjHBldthWFu0W:UocxApt73c1UBfmaHB3Ou0W
TLSH
T185F4E01FBB6D00A2E126813C89868345E3B3B4755B6257CB6691C33E4F379E8BD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e8b82c28c465c9d8f026084504c591e122841ed1fe7218035bee45160bfdf796
MD5 87f7f90eb5e7e5fecd9f5b59ae5d9ee9
SHA1 3a20783d1af25e312e010b6f40ff6afdc553d769
SHA512 eef901aab806e569adf947d477145f4841e6002771cd86d3f071c9c7998575d0ffa43213ab04867443626b75a31f736d1747e375cf7cdb82f822c6f08e456eea
SSDEEP 49152:AWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKt73c1UBfmaHB3Ou0W:y0zuNIJ73fVmah3Ou0
TLSH
T169A57C3DA2BC00A8D8AAC375C5461366EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4a307e3710c9be0578802dc28a5fae07e06bfb9900efe69ee87195dcbf2f9cfd
MD5 38cd6792f07fbef2c330d2947f73bbb2
SHA1 e7f04eb48fa2b2abd9f5021fa3eef26ae414a240
SHA512 6a543485820b2f70e8271bf2aa50a29ee6ff87891bd2b12a8d4b2f2836cf3fa048f04dc0b76c1004acf60fa0fb1f8f5c006963d4d9c94af1aa1c81e922231aaf
SSDEEP 24576:f1QT7EcpfxR+N5AWAz3ooiYujMqbq73c82R7VpWBPnmyjHBldthWFu0W:iTDxR+N5YzT4jMj73c1UBfmaHB3Ou0W
TLSH
T19055BF2EA7F815E9D17E85798A238512FA727861033193CF42A0C17E1F7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 877KB
SHA256 46d025fb07e9d3baa00b756b38187300e580ac24c8e53ada2ac962d6029bb442
MD5 c905c2d2d1590afc30ae1c730ea13d3c
SHA1 cff6e14c57ab7a07a5b4c9756ab16c89d4f39258
SHA512 c1747234ea09bd772f8a055dfdd880978f0844b0d74ece00bda7dde65005b859320252159cc3580f53364dcc81d0b330c99fbbf789514f6666a20b605cc84130
SSDEEP 24576:VTMdOz0FFS+bmSLW73c82R7VpWBPnmyjHBldthWFu0W:P0K+bmSLW73c1UBfmaHB3Ou0W
TLSH
T13615E13EA36D14E5E43BD17CDA438906E6727866032266DB06D0C1793F6BEE4397AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 9ec03358376168fe7a592f2e966c2c50d1f43025643636fcf923bbb10cadf7fe
MD5 d898ed332261330b625bd58c186e5dab
SHA1 46b6b5f3fbbc09870b1edf105587a63d5ae4675c
SHA512 7c53d6970d9cb3c5fd7a6bc0936113a5c8307bc4ad296c7da764f4b5e73762928ffcdd3002f12e87e307bdb125a1b77a3bb3fc625c99ec886bd6cdfb6df03b70
SSDEEP 12288:b47njvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:un73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1D0D4121D23E821A1E822A174CA260211D270FCBB53261BFF35D8D6BE5F36DD4997AF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/60-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/60-361-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/536-370-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/536-190-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/640-243-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/640-611-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/640-389-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/640-237-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/1148-163-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1148-364-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1148-169-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1376-7-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1376-1-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1376-8-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1376-423-0x0000000140000000-0x00000001400D6000-memory.dmp

Download

memory/1376-0-0x0000000140000000-0x00000001400D6000-memory.dmp

Download

memory/1720-371-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1720-213-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1720-207-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/1856-180-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1856-369-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1940-415-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1940-106-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1940-100-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/2392-81-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2392-83-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2392-71-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2392-77-0x0000000001A50000-0x0000000001AB0000-memory.dmp

Download

memory/2896-51-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2896-594-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2896-57-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2896-352-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3012-462-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3012-27-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3012-34-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3012-35-0x00000000004C0000-0x0000000000520000-memory.dmp

Download

memory/3012-33-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/3112-416-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3112-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3112-67-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3112-591-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3472-460-0x000000000D150000-0x000000000D158000-memory.dmp

Download

memory/3472-305-0x0000000001DB0000-0x0000000001DC0000-memory.dmp

Download

memory/3472-413-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3472-612-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3472-289-0x0000000001B00000-0x0000000001B10000-memory.dmp

Download

memory/3472-254-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3472-248-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3472-325-0x000000000A1F0000-0x000000000A1F8000-memory.dmp

Download

memory/3588-205-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3588-194-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3588-200-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3588-202-0x00000000005F0000-0x0000000000650000-memory.dmp

Download

memory/3712-21-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3712-20-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3712-19-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3712-445-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3712-13-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3784-414-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3784-95-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/3868-217-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3868-223-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3868-384-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4176-465-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4176-464-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4176-148-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4176-359-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4176-142-0x00000000005D0000-0x0000000000630000-memory.dmp

Download

memory/4192-355-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4192-123-0x0000000000520000-0x0000000000586000-memory.dmp

Download

memory/4192-128-0x0000000000520000-0x0000000000586000-memory.dmp

Download

memory/4668-386-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4668-233-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4668-227-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4776-530-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-522-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-517-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-518-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-519-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-520-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-521-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-523-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-524-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-525-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-531-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-516-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-529-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-528-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-527-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4776-526-0x0000021EE8020000-0x0000021EE8030000-memory.dmp

Download

memory/4792-357-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/4792-132-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4792-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4948-110-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4948-116-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4948-354-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5072-39-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5072-86-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/5072-87-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5072-40-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/5072-48-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download