7159f4896b3dd9cd3fc20b8e9b100ec38ce6882732bbe9dff6b5ed21b00e7a74

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
Size 3.2MB
Sample260929-stxtssac92
SHA256 7159f4896b3dd9cd3fc20b8e9b100ec38ce6882732bbe9dff6b5ed21b00e7a74
MD5 daf6cf54a6144c8c068bb11b3b2455cd
SHA1 77479634f400e59d08ae2972af384c777b50b9f0
SHA512 290c8c91c72f163e5005f2ef4f6bc8456780718465f3b6db34978b688c00d808086047803e41fd3b45f607616103931cf45917c59ec7f32d1d488f5927605dbb
SSDEEP 49152:Q5d7hBouOjkYu/Ouie5pcnjIx6VwjLfJ4klKXnADa38fXkMZo9gey09l:WBV5cERLfJ4kS38fx+9gzql
TLSH
T1B1F56A12A984849CF05A937447CD9523A9217C010B2CB5FB06D07ADFEEB6DE71AFB21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4364	elevation_service.exe
5652	elevation_service.exe
5184	maintenanceservice.exe
2792	msdtc.exe
964	OSE.EXE
4976	PerceptionSimulationService.exe
5052	perfhost.exe
3852	locator.exe
2788	SensorDataService.exe
3916	snmptrap.exe
5892	spectrum.exe
404	ssh-agent.exe
2372	TieringEngineService.exe
1672	AgentService.exe
5132	vds.exe
1188	vssvc.exe
2460	wbengine.exe
2348	WmiApSrv.exe
1716	SearchIndexer.exe
5744	alg.exe
1032	fxssvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	elevation_service.exe
\??\F:\	OSE.EXE
\??\F:\	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9b76c125227ba850.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\fxssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017047-466.dat	upx
behavioral1/files/0x000100000001700a-465.dat	upx
behavioral1/files/0x000100000001742d-470.dat	upx
behavioral1/files/0x00010000000233db-471.dat	upx
behavioral1/files/0x00010000000215b4-478.dat	upx
behavioral1/files/0x00010000000215f9-482.dat	upx
behavioral1/files/0x00010000000215c3-480.dat	upx
behavioral1/files/0x0002000000022bff-477.dat	upx
behavioral1/files/0x0001000000016791-476.dat	upx
behavioral1/files/0x0001000000017035-475.dat	upx
behavioral1/files/0x0001000000017812-474.dat	upx
behavioral1/files/0x000100000000c53b-472.dat	upx
behavioral1/files/0x0001000000017bd0-467.dat	upx
behavioral1/memory/5744-787-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/1032-798-0x0000000140000000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/1032-804-0x0000000140000000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/5744-814-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5192	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015a147002750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{29438B0F-70DF-4583-B773-C07620DFF777}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4364	elevation_service.exe
4364	elevation_service.exe
4364	elevation_service.exe
4364	elevation_service.exe
4364	elevation_service.exe
4364	elevation_service.exe
4364	elevation_service.exe
964	OSE.EXE
964	OSE.EXE
964	OSE.EXE
964	OSE.EXE
964	OSE.EXE
964	OSE.EXE
964	OSE.EXE
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3420	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
Token: SeRestorePrivilege	2372	TieringEngineService.exe
Token: SeManageVolumePrivilege	2372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1672	AgentService.exe
Token: SeBackupPrivilege	1188	vssvc.exe
Token: SeRestorePrivilege	1188	vssvc.exe
Token: SeAuditPrivilege	1188	vssvc.exe
Token: SeBackupPrivilege	2460	wbengine.exe
Token: SeRestorePrivilege	2460	wbengine.exe
Token: SeSecurityPrivilege	2460	wbengine.exe
Token: 33	1716	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1716	SearchIndexer.exe
Token: SeDebugPrivilege	4364	elevation_service.exe
Token: SeAuditPrivilege	1032	fxssvc.exe
Token: SeDebugPrivilege	964	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3188	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 3188	3420	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe	112
PID 3188 wrote to memory of 1784	3188	msedge.exe	113
PID 3188 wrote to memory of 5192	3188	msedge.exe	116
PID 3188 wrote to memory of 3184	3188	msedge.exe	117
PID 3188 wrote to memory of 3184	3188	msedge.exe	117
PID 3188 wrote to memory of 3184	3188	msedge.exe	117
PID 3188 wrote to memory of 3784	3188	msedge.exe	118
PID 3188 wrote to memory of 3784	3188	msedge.exe	118
PID 3188 wrote to memory of 1004	3188	msedge.exe	119
PID 3188 wrote to memory of 4952	3188	msedge.exe	120
PID 3188 wrote to memory of 1004	3188	msedge.exe	119
PID 3188 wrote to memory of 1004	3188	msedge.exe	119
PID 3188 wrote to memory of 4952	3188	msedge.exe	120
PID 3188 wrote to memory of 4952	3188	msedge.exe	120
PID 1716 wrote to memory of 5608	1716	SearchIndexer.exe	121
PID 1716 wrote to memory of 5604	1716	SearchIndexer.exe	122
PID 3188 wrote to memory of 1176	3188	msedge.exe	123
PID 3188 wrote to memory of 4536	3188	msedge.exe	124
PID 3188 wrote to memory of 1176	3188	msedge.exe	123
PID 3188 wrote to memory of 4536	3188	msedge.exe	124
PID 3188 wrote to memory of 5148	3188	msedge.exe	128
PID 3188 wrote to memory of 1692	3188	msedge.exe	131
PID 3188 wrote to memory of 1692	3188	msedge.exe	131
PID 3188 wrote to memory of 944	3188	msedge.exe	137
PID 3188 wrote to memory of 5944	3188	msedge.exe	138
PID 3188 wrote to memory of 5952	3188	msedge.exe	139
PID 3188 wrote to memory of 2732	3188	msedge.exe	140
PID 3188 wrote to memory of 2732	3188	msedge.exe	140
PID 3188 wrote to memory of 3428	3188	msedge.exe	141
PID 3188 wrote to memory of 3428	3188	msedge.exe	141
PID 1716 wrote to memory of 4712	1716	SearchIndexer.exe	144
PID 3188 wrote to memory of 3692	3188	msedge.exe	153
PID 3188 wrote to memory of 3692	3188	msedge.exe	153
PID 3188 wrote to memory of 1548	3188	msedge.exe	154

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://im.qq.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ff9cb36c188,0x7ff9cb36c194,0x7ff9cb36c1a0
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,9548753129765079122,14302931003068661488,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16570667511885553045,17644553890667469223,262144 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,16091528720936627097,14073124643943139514,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3356,i,4353248077880199185,8868909301709604110,2097152 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:1004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,18226967209402350385,5887301124403008504,2097152 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,1604108498219721785,2205719713242088100,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,15531948397394200550,15869022265492651093,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2795451241644447618,4816108149343613011,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2795451241644447618,4816108149343613011,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,16984251606090449630,7443346795047078011,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6825575775850926541,11886599459433695798,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,17510369893231879446,17492323124033621818,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7127859554361551116,3225151536485422742,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,1286966613950473695,6760052329930687944,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2282918478396115163,8467536816759917637,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:3428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,4286131170661275453,1946045402631218508,524288 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:8
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5620,i,17671811768769386780,16483956593035658195,262144 --field-trial-handle=2176,i,6214501798829898341,8692219293628242087,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5652

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5184

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2792

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2788

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3916

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:5892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:404

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2996

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5608
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:5604
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2091445952-3649787497-104050984-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2091445952-3649787497-104050984-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3320

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4920

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e6ac1af81eb40313a40e905e8d157e0001b7d22e1d23e1ea65df9ae6fddc1faa
MD5 1fc88e0f93d7dc0574f5684ce2f3d3da
SHA1 2acba05a367089396d4d205571d19f65071f0bde
SHA512 503cefba570eb74b21a07e5faed1b2382ad867be450bb3d371cf266fba66be704b8ff81b9af85e84260523e624542814a56c81a3af1dd1f73fe8a4c248099571
SSDEEP 49152:9b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnDfJ4klKXnK:D3q6mjBcfJ4k
TLSH
T145D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 51b2b1ec9cce810d90b8348c6d4b59e879e211bc36131efea128fc34733fc126
MD5 635b1fd8f571025b1ff8721ee4ca39c9
SHA1 a9b5cf2151b0a437f8cec6da2ebfd0b1969de1fe
SHA512 197cf09021e2f66e5a9ed78daeebed9d4f9c39b140bea442d7031c4b8b9acd6e6aaa9839e57a429ec4fb5ff65a4b6fd1de5084bae9f248ceb81eb84a2c937909
SSDEEP 24576:oXYfDtczA4fJ4yL/tNCJPXUQrPP8Opa392l9X3UC5X7Nr89ge0NZOa0l:/tcFfJ4klKXnHla38fXkMZo9gey09l
TLSH
T17F75122963E488F4EDA7927CC9A19101DB33BC864374E39B03A0897A3F276D95D3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 0c12322bd43af2782556b67e23f78a33f662f10c102ff99d9109d22fd3f0d8e8
MD5 70bd3ce927eb94a5c301ec9aaa9d37c7
SHA1 589debcab4125db298553a0ae5e10fd9d2413bba
SHA512 64aa09ca0ace975369d0cb71aafc0ec47af02cae972bf534b2e1b97b252d0702658b2c21e7987493f7ca43709713a320454476f754f27104322bbb4d29166640
SSDEEP 12288:G1XLsswWkxy2lRq2czA4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:kXYfDtczA4fJ4yL/tNCJPXUQrPP
TLSH
T16605F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 69e62bf81ff384c1c7b6c5b46c11e758a20253d615bff3959a9c3eb7c434e3c4
MD5 ce22761ddd42d638f3e48d790106ded5
SHA1 4945a354e2fa490c96c12edd11f81051e221299f
SHA512 3b1f8c7b7cef60c097c2abe6ec317eb91b9213fba38d7729817d8994751a2eb6518dc40a8d941fe830cad1b000d4d537d2d362a0fc77e8d822367b6338216568
SSDEEP 24576:74ffJ4yL/tNCJPXUQrPFYOpa392l9X3UC5X7Nr89ge0NZOa0l:UfJ4klKXnNpa38fXkMZo9gey09l
TLSH
T14C5523564098F4F0DFE8F5FC1B583141CA12BFC7137E51B79A41A9AA3BBC966984E302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 c38e32c7df45a82914f37412fe737ccb16067bac19ba2c6c7d436308465cbe23
MD5 555bd3cbfef8dca9cf70c475167ebfca
SHA1 168f21b7d8e863c49c9f86e991a3605e24a53e64
SHA512 36e028456a7dbb228eaf5b6c6ce09237a218a425b79e7aff30596abbec2b18e5770df82a776136bdea5235bfa5085c4d0fc852b1032f701d7725d3df9fdf6833
SSDEEP 24576:SJIUUfJ4yL/tNCJPXUQrP0gVUBF0STEYDElHWoVSL97d:SJIUUfJ4klKXn8ygdAYDEZcL9d
TLSH
T1C675017BAE28FCD2C67A8DB85B51C200D77278704F62A3CBD165C20E9E236E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 5.4MB
SHA256 02d0115ad65cce0ce65f182d5953321c5a19664eeaa5f651b4c756966894b623
MD5 fbc8bc77120d7ff43109a505e30218db
SHA1 0771bf123478ec33c257fc9d9f10c81b1b46570d
SHA512 e64fbe544b7a3b85446ed096e59c2f89fc51e37abadec005b024b313e0dcb44203279da08ffa2f26aed75f2336586b4b95c55ad663db65d80e98c5b70029138c
SSDEEP 49152:rQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJY9DN5JxNRV3TH0:rQvGAdlCEL8c/YRNt5ClfJ4kmg1EZa9d
TLSH
T12B468D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5586ea84cb7eb967c794e372187b1c1c48b987f11e16df6fe2e53b47e7d3ade8
MD5 baa310f4baabc3973ca9ee947da5c9bb
SHA1 c28708fdd505d528e80bccf4ea7f5a3851310f1b
SHA512 1aa92b568a5b5615d673a86cb09d52cda35f75fd3dee72ed525bdb02c26555d4ffea2ada7db03c5b1d221663e79a8cba2331bdb8ab8e0312b5230a34c7f37d92
SSDEEP 24576:M3ewsAjOfJ4yL/tNCJPXUQrPb9VUBF0STEYDElHWoVSL97d:yljOfJ4klKXnTTgdAYDEZcL9d
TLSH
T143851231FE75E022C77B0DB21B35D306546D7A500B621AC3E3E89D9E1A742D2637AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 59c91fe0317a30fba80a111ca8bee808cc4de01b664aadfbd23d60adfa10f073
MD5 30f5fb9ad155f14e2812725fa8c8bdc9
SHA1 f37eea93317539e7567909851fc0c215947a2d6f
SHA512 00198b37bb65c7be09256a4e5dfa532911e1df5b2827f71e9d152ae834bce84441da5748c1b6b1e388a844c3d3536f18d246089830ba890282a0e6d6f22d19f8
SSDEEP 196608:1UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHGfJ4:1UEtQevvqc2W1cpV20I32G
TLSH
T1EA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 4.0MB
SHA256 10c2d1233b74bb3bf605df117837509cb75684570a67118f2fe2fe211e2749d5
MD5 6a00e335cfc059945ded95154eeb9bda
SHA1 f94db443601a8510f06d92637336c2fdec55de2c
SHA512 6289f3eab45b5d037ef0196beb32fb946528abf4ee24e2a60bd814ffeb5b6686a1714039f726bd13acdef3bd0c7734d50799c59ce2e409df41543e00398ee748
SSDEEP 49152:g6bRquA/m2yL5zOfFiV+XenmE3/zufJ4klKXnTIa38fXkMZo9gey09tfJ4klKXnM:9oq3VjnmBfJ4k+38fx+9gzqtfJ4k
TLSH
T16016CF0976B8C1E4D1F6C77886A2C643F37178154B35A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b8de3b563a4c39e5ac4421b4541dd7239957eea01c4ad6d861b5a6439c2c824a
MD5 4cbb27228dbb45c8b9c27c5e96e87566
SHA1 4d60aa186f279c0514c51683b767982d14d2320d
SHA512 c710023c121a38f15a647dd2f48560c3c23c975ed38a33a3b7a1c9c633ff60b4a805c2754c224cb4472b38bfcb485f37a4c1f0b755d032cc6dd601daa6f764ab
SSDEEP 24576:vAhGL6IFoiwtA5l7S53hfJ4yL/tNCJPXUQrPc:vAM5Foiq5xfJ4klKXnU
TLSH
T114359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 56a42d6d176283c623c0d34698a38d0827388936ff013aef7527559977ecd891
MD5 4fe0006c5326a11a2aaee6da3ccd7fd2
SHA1 37910306fe918f436f255de49cd4768cfe512da3
SHA512 55335a822c8c0013cc82b092fcd614e7720c79a59d50cbbab4132b033765cc884af3e2bed0662ba5f8dbe6ae3dbacabb13924422104885ee877388b56ebfff6c
SSDEEP 12288:Rmw5HEjsChNEBFgl0WDm+CVfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTD:MwuROW6fJ4yL/tNCJPXUQrPn
TLSH
T12705014A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 25022db24d6e00e632a503ff060f9adc03e44b94c60b3dd136882e8fa8d17f22
MD5 ae7dd22a9fc41d883cb74b098b44f1df
SHA1 a2127ee9929d71da8fc5499ff7ccb2f491bafcc4
SHA512 c42deee725d791d9c3f6b389632d435f9892bb6e161a3ea985e17c951f6a6ec8fe0a5834cbb1dd414f8944e7a8ed123acc2f3779ea4c6a07d871a51f216dc6ff
SSDEEP 12288:hyZ1Iy+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:oZuzfJ4yL/tNCJPXUQrPb
TLSH
T1AEE4129B32D460F9DAA782BC89D4E101D3317C92273A83CF5A5155963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 55d651f7391231cc99263ce0be0415717a73bbcc9bbf4265072d704e12e1ab77
MD5 25d841981a855f0fc4977a2a63054434
SHA1 3d960c7c38dd2c9dc7d5c1504509f3c88aaf73aa
SHA512 f23a76b91f52440486e3aa94aa4f705a9de05701f6d2ec15847eddbf390325a1418cae0682d1e298420e2c9fa39e4decc0d42791930e9ab34e6c256a1c1c31c2
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UO:uQRQyi36YOcPDLvw2gAf+PN3gfJ4k
TLSH
T1B4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 830e5e13d781fef6102e70a7089f30905de998dcf1cfcebd933173728f032105
MD5 e53ed059b3c65d92ca355dc8dd86a924
SHA1 aaba4d0515f07151a873a314e1c4a42a1a902b1d
SHA512 74e1146c1abe5af45fe63e4b9215e2ef6d939d23449b0383a330cea9cbe80cb5ea7ca5b8af3e8b764db4e856257affee2f786ab44f4591ca757838cb92f73994
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U7:LQRQyi36YOcPDLvw2gAf+PN3gfJ4k
TLSH
T146667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0220a433762c6cd28b99130cf6e0c3960f1548affdec4d9c9bebb772230ff1c1
MD5 e903b795cafa3b1c0365d432ce75d254
SHA1 7497d099f0ee97376b6e2cc26a12d1271e17ae92
SHA512 682843d1468a3e454e32fa10a72af01dec8c1c9680e1b87fef5ffa373d99e8bf0b82ff7c37601c72be746f0cdb1557e8e886f76cd355bab80c0da59053ef4744
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0DfJ4yL/tNCJPXUi:v68Qg55nhkeWu7PNU3/efJ4klKXnJ
TLSH
T157B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a483b4f5fa3fabf53aba562cce902d5a78e2e1c3fcdf93fc2a513c252ca7f332
MD5 f0ee48d3eb6862ac8d3102a270136613
SHA1 bd7d8639e8dba916bfb55c8d966a12b542b7366c
SHA512 45e99a51098c45613a2abdf13956955576091ab0e2a521ef0e5ccc43533439c580927cdf0657a83a4a97ab60d92542f2b66129bf37736dfadaba235311a6e3a4
SSDEEP 49152:03aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99O:hy5112gYy5azzVvU69nLKnhZffJ4k
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0acf7315797e86269b51956bbbd20673bd311ba872753bc19a39b68125ab76bb
MD5 01ac9c7712e37749756fbfe17bdeabaf
SHA1 aa1792025a098e40eea5b6cec203bcbc6f53d326
SHA512 765fe0c305c313110f77e98cc651e15111b07264f281ea3a2d5abf111b707348a54e588f5893ba8ade5539b0199fb6bb051e29b779420105d07511ee170b2377
SSDEEP 49152:nB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glIfJ4klKXnV:pu6JmIxd2dIfJ4k
TLSH
T12FD59D13F1D901E8D06ED078974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 05488fd11b1b0ac65f9f0376b507e9efd2acbc63595682173e9a61c8c83cf7bd
MD5 1250b401a5485c3fd6a04c950a7c8b73
SHA1 69f72e6715a17bf032d7b4313536c6ff13b600de
SHA512 455b1fa777fafecc8d5cfaab32a12bb30863e6664df3bf5f3c0eb4d2de65e0262186d10f3bf44d5be950866766eed19f1a1c7702907564b45af0a3b0dfa1cc08
SSDEEP 49152:k1hpsNoJpF1A67U44CwH7R4x0fJ4klKXn9:kmifPqRBfJ4k
TLSH
T17CB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5cea19886a356d24c17867656fa83cea1ebfa27fe6b3dc56861221d4656a0bdd
MD5 5819c92c74dd35c847991db98be604a3
SHA1 c4f5188b7a9c386d884065e4ed6dd9bebd695901
SHA512 f6cf227e0e1d9a1c74b7b75783744fb43e4acca59be1455fb674992dc2011e2b37134e84b559a199f620aebd7d6c0135e75e94f72a733f8cbd205bf51df5652f
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqzfJ4klKXn/:p5dKqi61zfJ4k
TLSH
T154C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 12f05f6c81e10c21f9af40f60d23bd8a189c073d698299562422bca70c45c909
MD5 ab590ecbe3cdb745a6ba9c8e682eb3b1
SHA1 b629035fd93bcc96271dc05373124788699ffe61
SHA512 7e3f2329e7068478fe82d240de4ad2d4f2a6626ad02fc292f80f3b84a91276eccef91d3b1f0f63a371839798e4b96e48f873c0e51cc061ccbf6e10aba13ee9d0
SSDEEP 49152:GhtSn8EApI0figjgiDn0AP5w4fJ4klKXnR:HX2iWph9fJ4k
TLSH
T1E495BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d87380d850a0154a68d86b1b1a8babfbe1c74944e7ff0616dc1d7c85156bb93a
MD5 7abb44fc5845523355bc24ef2d99ade8
SHA1 74bb9efb45defcb3b34f67809653edb376ce4f53
SHA512 48a1e06dd9ba38122e48a83e3415ac79a1a70ddabdd72b16a1b45ffb917ac26cee983b6e38114b858a081212991de54666e616a6ab37e60e1c01356a19a14a1c
SSDEEP 12288:xnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:xnfJ4yL/tNCJPXUQrPK
TLSH
T1E4C423AB60D5948ADE1587F81A88F001C7087EC6672F62F7EF42B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6caea17a644486efe25098891bf253a46b89f62b298c4b00e1bb9918e5cdc34f
MD5 0bfd8e5cdd40cf2320ebbe0984f56171
SHA1 e237d457aeeb4c160b58db18752377e47396632d
SHA512 f26cd39332b49d90151479866fc29a5a7c4dfe5971dc54de6897d18c6b529a5672d8a7e984ae26a08f6a8ea8888ac2067b82b15863a8c96d9aaf5e9dc5d589a0
SSDEEP 12288:dyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:dyfJ4yL/tNCJPXUQrPK
TLSH
T1FEC423AB60D59486DE1587F81A48F001C7087EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6563af3e1527dcc0de798eba1098ed73a2dae2c05ca0ee51d08e238cb8c99ed1
MD5 a8733d449690e6f68732cd451effbee4
SHA1 e8b9eb3829be7a32fd2bccab96d9a3f09f39635c
SHA512 d058c428a6c9945d17667a2378f961d2c29002ba9ae4ecd1af6487e01cdef9dc9ec28945af497ad3f132694ea410ff76b1296c2b78b31e35538bc16f3b3fa8d7
SSDEEP 12288:0cfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:0cfJ4yL/tNCJPXUQrPK
TLSH
T170C423AB60D5948ADE1587F81B48F001C7047EC6672F62F7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 97ec20b8f2b94a049244bb4f3e02b44ec5088e891c386ad224d1f253aa5d3823
MD5 17c59ff631e3fafe664d0929496e8d0d
SHA1 ed7542a2d852e99e5937e14267b398b85765d0c0
SHA512 3a01ed973a95058b3fbdbbf8f0a3bdac2f53fd2ab121de9572a33c9ca7802ab88e2743316e73c6e6eb146188daff8ec66e41f359bf25bebcc4c87d8d4835a4cc
SSDEEP 12288:8VBfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:4fJ4yL/tNCJPXUQrP1
TLSH
T1E4D423A7219580C6DD62C3F84A44E001D324BDC6673BA3EFDF4268863FF9659296C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 7ff1a31b34207a2958a44cf437186919e7e2ba1f99195d0f83a1a464bc1961a2
MD5 f37441a9480eceae8d8142f5f11ee30f
SHA1 bdd7c2e857180399f6fedc2cfb359e5a1169224d
SHA512 360e1f8fa81ca50e172bfcb1395cc4b00f90342720db5ae72b44861e069738051d8d21dbe996a9d1592ac7fee4684ac72e2a3239b3c6fe333132c5b807d3262a
SSDEEP 12288:A5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:A5fJ4yL/tNCJPXUQrPK
TLSH
T1D2C423AB60D5948ADE1587F81B48F001C7087EC6672F62F7EE82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d23e62f1b3efe91213e21c5d928a9c4d2296054602c00a7d31d9287c7d82d07f
MD5 955bb806e27715db125f2ecb42bcd5c4
SHA1 b22b553ede71b8acacd591b5d5bae26d4a7c4ade
SHA512 8008029d37c820b6be3e4921a16400e35ee4ecd9a9c41ecaf3126943f4f0d6ee66f6feeb5d13e24793d41c1f21c542ed9afcc5d97e4d4034d8135376fcb8e65a
SSDEEP 12288:f2fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:f2fJ4yL/tNCJPXUQrPV
TLSH
T1A2C423AB60D59486DE1587F81A48F001C7087EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 db17400863c9b13c187020e2234ac21aa52ce50b48f99c6cac10abcf5714bf7f
MD5 b0acbbbf2985e0934dfac19b9c94eca3
SHA1 5534c7de9df5c4c947dad95558ddfc7e2f6a62e2
SHA512 4cd86d88fc383d7af68360756dff5a8db83676b2af43fb1b2d65a78b1573c108c63853d5ab7c674a1ebfb695652be41214d8a5273f66b4e71ca48d9bac983d85
SSDEEP 12288:UKfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SK:UKfJ4yL/tNCJPXUQrP9
TLSH
T1E5C423AB60D59486DE1587F81B48F001C7087EC6662F62F7EF42B4817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5ac92a04d4adb4fc3709f1c15910dabe07a2bd1f825b6ff156951151b7fbb333
MD5 b2ad2d9a6d9a6fae97e80b85023c9575
SHA1 34874f30f0bf10e26223235f1b4a651698043217
SHA512 a1d6d7353d163cbd18f50a41b605b4d0b0ee2245bbd9ef1ee9ba6b7ba839163717bf779be0611cf0d804921b3ac37eba71cddee94d1adbec0753397422ea97b1
SSDEEP 12288:riZwbDzzFEoS2cPvySfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:WZM3zFVSOSfJ4yL/tNCJPXUQrPg
TLSH
T13E0501A5B39018F8EC67827D8D549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 541880ae17d90e761c789f9425186b508fcb6b28991e7491ab50412c179b3177
MD5 ef05c74b2f0a9de7a13087db36f72a1a
SHA1 a89fc3fba48a23b7a0cdae5a87e3d590e8f52c95
SHA512 b07455eb8a4e4c74b1b0a0d3f7aa2afc332b90edfa1501e18eb81540d34d737b7291ae7c5fb3f774c3a18cfdea80528c58db32c723fe2ed2e112fefcc752c642
SSDEEP 12288:LjfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sx:LjfJ4yL/tNCJPXUQrPC
TLSH
T1F1C423EB60D59486DE1587F81B48F001C7087ECA672F62E7EE42B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 430e752ee1bab4209a0abab4212a43c82a08bb30fdcd7975f60e1fb285925a74
MD5 7bab638e01f309ffa7c98c1660e05a89
SHA1 e17375dde882b37140b0df89b8f03dc6b48a6a84
SHA512 126e64a15386b580d8ac76a385097ea5e5e1a7448cda06ee0d97993f32cb6a5550bf020ea780532af18f45e488c1ed50aa89597ac7d184786b6987de875da89b
SSDEEP 12288:uPfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:uPfJ4yL/tNCJPXUQrP6
TLSH
T18BC423AB60D59486DE1587F81B48F001C7087EC6672F62F7EE42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a113dd6abfdba6f15d35c558c0d376538034661323aaa845da7a6ad2518c66d9
MD5 19d67bd6bc49457d885a4460485c9b63
SHA1 36d54df88847bb34323cddc6d5ee95238636e5bd
SHA512 49fc376f0af06562f8006bc34fd0525323c447ff0513c57eb897a7519200b5ca0ea7934de2dfe5ead17138687044c099f040043d3156d1301d7ce0694bc561a8
SSDEEP 12288:dyPz5L8+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SP:Uzy+fJ4yL/tNCJPXUQrPQ
TLSH
T14BF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c0805875b70af403c1ecf91581f993827c14c5c4f681eb3429080ef1c0d755c5
MD5 f3357532a82f5e66b4b786e2f9d05ca2
SHA1 5d09f28efedceb511eccab8ce0f93f9b6f9a344a
SHA512 3914a3a2a2708968b9537cbfe2acb8ff49668eaddf617a358a4bd759b5db3351eec3c5c4bf3b13c1d706c634e31fe53af8278cf7722eb408d1b9169b230bdf08
SSDEEP 12288:ijfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:ijfJ4yL/tNCJPXUQrPV
TLSH
T150C423EB60D59486DE1587F81B48F001C7087EC6672F62E7EE42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 aaa8c70d73bcbab49d902dc500f2e4e2029ea96a57f16019549048ba822b7894
MD5 123ba896192d6e779783860b172e77a9
SHA1 477c1fdbbffdde983475dcf62e352fb2966119e4
SHA512 a685e4f0921ffa8267f09c4b2a0371b81e3cfac7e43677719db3d374b61e36b79ba67557da02af516b60f9f73e61a9f3331c0a9da4bd1832320b8887dec30340
SSDEEP 12288:djfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:djfJ4yL/tNCJPXUQrPV
TLSH
T1DFC423EB60D59486DE1587F81B48F001C7087EC6672F62E7EE42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 48bf4fb276a948d7ac3837ddfd79bfb63d110c331f9bf86da0e1cdd8053c849c
MD5 eb28603a79f35dad7b6ff63334511a38
SHA1 ebc750e8f974424be858b4a857a51bb69dfe82da
SHA512 7f9d6a3486db17e7bb28dd18fc96188aaeeaca2b4fa161813c871042f0e6827d2e3d78291920fecd53374b3159a002d9619028db54e0abb963dd433ff30569a0
SSDEEP 12288:IyPz5L8+fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sk:Jzy+fJ4yL/tNCJPXUQrPr
TLSH
T134F4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6A15E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 b95e0955b7a818f459897ded5d932c87a49dbdc0affe2d109291d81193d2f184
MD5 005396b370ad9f108e8c56084f1ad406
SHA1 3dd0ef7cce0d25a5d41b0d3e6288470d50f069c6
SHA512 881d3c70b27c41112bb7b1c8b24912e66b8f6de8c7e9cc05de0e27ef0845680bbcc976ee12e0a1dcf2a14c3923f408394e361fece00f4b9520926a5ccef98b6b
SSDEEP 49152:1P4m4IpOO6708KlfJ4klKXn6Da38fXkMZo9gey09l:bppOO1ffJ4kI38fx+9gzql
TLSH
T11BB5E02DA7DC4095D0BA917886658A09FAB1782E1F3286CF1160933D3F7BEE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1401889171\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3188_1401889171\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 f7d8e29d15de5c681d83cf1eb097d4a79df87ccb6821085f1b0c64094e728085
MD5 f4bf80a2de500d542beef38d0957b3fe
SHA1 a502ce05e796fce821b8e34213c371c49da6cff9
SHA512 d4508e65dbc39f6af95bc8668fdbb16c9da1be267d9362d902098bc3df1b7d77076d7bdb536392caaff5fb6113720777ae2aafd91f55e98b68a858f331c58ffa
SSDEEP 12288:LpsfzfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sy:8zfJ4yL/tNCJPXUQrPh
TLSH
T12CE4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4f72955a2a02faf5008002c50d363b5dc27b2ad11a8cba1602a76acf855439fb
MD5 4254afdc46415083482c1c7b6c6dd49a
SHA1 e3bf2429d6c3082e5abcb9fb806841b8a8ad90d3
SHA512 c641c344f27ca077b411930d58a5d075e88aed959ab62c3264bf8f20551af3f6edabe7bfd7e8fa5898e9ef28a4d0c6337a7700aada10c6d32cd4dcbdb56b08ba
TLSH
T1D7F0F4B5CD21AC3B18FD0B2920A40746E750232B2B81A84F3B3D810C8FB463B85868AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 feb56ad0c6b5a6e32106a1169d74eac34d65256bc52b0f6b9aa0108ea9231d05
MD5 2c9d854bebf9d24653b694265756414f
SHA1 b7d6d6ab25d577df6957208ad551e7a9baf2c4c0
SHA512 6d8369a49b42532ab8966b91022928c121a990db92702484dc864bc1bf99573a053419bed29a28f30cf4847c778cd90138cff51511da2cc2548854586233106a
TLSH
T192513D85E2645CD9E7BC4F7689C1907B763449F1745BEC0F09A8C43ABB4B318721439C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c172.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c172.TMP
Size 2KB
SHA256 adf8402594185056002a3792543e23e03813c6c1039c42599c6619e5e8a6106b
MD5 3d5cb5f6a7961057dd410588cc7757d5
SHA1 199de024c35aa0274a07e9daae38b00c5e074824
SHA512 db46a0a6c999230a33d3167a45630af469cd400325470fcb851a5d17cbce156051104e9544721d741740acf963ea6810638db12f169b03465cbbff0a1400af41
TLSH
T140411D96E2401CD9EBAD4F7689D520B7763448F27487ED0E4864D83A7B8B318B21839C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45618edc2290d0a5f93dd2f2d470ffab9c6ccca919787b348d49b4725eaec4ae
MD5 c1b8e1f793e10d598e8a33d50a7c365b
SHA1 ab098ef88bb9feba9287d7fb65c949dfbdf00c3c
SHA512 a92a71e4d4c283f3f3b9f22ca0edf8b6bb8d3251dbc88d02e73389efd9f80c5674e1f8c11ceb4b5d4c5f0a13b684cf29d30bea635e260ad81e3f2c65efa88a5e
TLSH
T10451A0F383B4856E8A0195F0E61CAD2FDE6D0516432C7D9A85E4AF1B93F3471D180A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 837afa42298dc5748d2d4618ce6e97c8c4f3e416fdcd7a0359709354072421f3
MD5 0c68bd99780f8f3deb584660e36d4565
SHA1 17ef5ec19071e3745d7547f2aa0fa4e9edb70700
SHA512 e40710a2a5d5a352d0045826e3c118a9e2db6b045e09a43b8d142f536ac2caeaee03acdd9f7268c509d1d8db90959c790cfd2778ffb1e7ccfe73be8d080e4fdc
SSDEEP 192:sxZVRIiA/flsBaQZLjs8CzodpYcHW6+WNdmt/Yoy2S0gMKIgjt5J:sxZV3A/fls0OPj51Hb2/NSVMKjtj
TLSH
T15842F955AD28A97B8CC7D219FB197F53E3F9503394811E48AAFC8A1C14EB6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8ab1f13d45351fa88d6ae5e2e498c2643606cc4b230539a9d3788ef33c057e1a
MD5 eea0724dc69eb4f05351882187b7032c
SHA1 2c05cf087661a732b11b548c8e82575d50fbd697
SHA512 4f68b863240bb99b4aec8e4f0f379c945cc5275a92e82edbee73278b3c64797546db9b41ae51ab6417f42fb9dcac939556172906816eae1b3e5038cdd1f630d2
SSDEEP 192:sxZ0RIiA/flsIQZLjn8CzodpYcHW6+WNdlq9YojoS0gMKIg569tvJ:sxZ03A/flsIOP851Hba9+SVMKqtx
TLSH
T1D7420955AD28A97B9CC7D219FB197F53E3F95033A0811E88AAFC8A1C04E76DD620341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b44d8c1712b815ebfa22a3db884e62aa01895d335d42e4f8f269a7b76e048daf
MD5 2d69f502f5a81eb09b07141b807842ac
SHA1 2ae480d471c0990512ec15b42286d627cce20c73
SHA512 9aa9ea2d107d16f78966c8ade6f8d5817d45c382799701c8d9a0f60780845e93b76940a6ada5d33e796b25654bd5c277084319b134d26a5db7fdfe0cf810ad05
SSDEEP 192:sxZ0RIiA/flslaQZLjn8CzodpYcHW6+WNdmt/YoyoS0gMKIg5et5J:sxZ03A/flsYOP851Hb2/JSVMK8tj
TLSH
T1DF421A55AD28A97B9CC7D219FB197F53E3F91033A0811E48AAFC8A1C14EB6CD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d5767d079919928f98db7a2a300b70de892475837dfe6c4999f1eced79bb4ba9
MD5 9ab582e5d01109658fd2c065e759f85d
SHA1 a986b69cd2ca84c8947546cd32ef24dd5b0cd41c
SHA512 0d34dc1844d3770265aa2abba97285a5cab7324c1c1d7ce0bde7fd9d2dee98baa4098df97a6b23dbdba16fe9713a513a6037c34e56b2b1465a1874aac734b024
SSDEEP 768:Px6r8sW7pLuLbG+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz1qpLlvVajYroR:Px6r8s2EbG+WviyUKu1ja+1qpLd4jjog
TLSH
T1A5E2F97B780CCE7E4FC05A9DDD1A7F8B6DA802CB9698C94087FA945C02C67EA51170DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 8693e2a915d2426d56b9ca5c80ebb54fdb66f448e2122a82480023f8fd568a7a
MD5 65496527cc4277d3d4281327b30b6b82
SHA1 45572026192d3ccfa481041990030f087710a78b
SHA512 fa0dc091d615b4e22730a49cb9bb376c60bcb81cf1ea2350884929dbfd62cec121566c795ecf569ca2023c4abad7297e3ff34cf6d2bd9d698bcc8b2854ef5002
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgw:ST/2dXOJhJlpfnpp3tNXVrN3CB/yxg
TLSH
T12DB2341571BB421039FE291C92B6972E064231B33159E66B7FBD04B68E2BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e7b335ff40845e6aa089a432f6e7e932170f01ade4f0cfbdc7e0ca491c4e890a
MD5 17795155d894757b65e835c50c6452e2
SHA1 24cfad0cb1de35b8900e13bb6c34ef7cc30776ad
SHA512 4454e2a9d94a243103e3da6acd67e29fcdae1fad6977113c1fa6be8bd3c486aa66ed761d1eab3ff023ba2fee45abbe572aeac0f753c598c7a11d63be12e793d1
SSDEEP 384:nKiFiZcI63sNs8TUNTUlIm2aKMiN4w2fLBCv4ikA6d/XYsa+VYMdgL/7IzGoR:BFQ63BwgcAoBCv4w6BXYhgKa
TLSH
T107C23A32EC98D9ABE8FA4FDAAB4A7603DEF40163959C5AD4DAD81D1D00971DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2400fd91f0f63c4e02044316cdf38ecbd1aa036984e72569e138dc6616c63237
MD5 e380026db45b24cccb7e6c0cd8d544a1
SHA1 0e67d2713bca1e889b314d4d3acb14ec388cc5c4
SHA512 313f1300d373ad0b76e1482f0db4100462471e65b2348997f534e1462838cd12bf52534766e50403be7fd5b5019a8e36786127af3a65c33b0623e2df24e0dc20
SSDEEP 384:nniFiZcI63sNx8TUNTUlI4gaKMy39w2fLBCv4ikA6dvudkjtgOIwZOyHUgL/7IzG:iFQ634wgmm7BCv4w6lukjXso7
TLSH
T125C24B32ECA8DABBECFA5F85A74A7703DEF01163959D9AD8D9D91C1D009319D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 071fd41ca0eb9e370e7207fb1b68d5f07b0a473710e39a6dfb88ee06ee6b708e
MD5 667880579ade80f21310033f73a1b0b0
SHA1 284b824223caa30bdb7e0d6b0accb5bee5416ed4
SHA512 61053c4319588266732359aabcc859ec6e54e867ed3cd9943c8ae3b114711f7e4adbe72342630fd251eabcff8e54c2c0fe2ed7104641bd8150a5792f03c1e44d
SSDEEP 384:nHiFiZcI63sNx8TUNTUlI49aKMy39w2fLBCv4ikA6dvudkj3783gL/7Izdo9:CFQ634wg9m7BCv4w6lukj3w1m
TLSH
T1DBB24B72EC98D9BBECFA5FC9A74A3A03DEF41163959C9AC8D9D91C1D008359D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bfa7707dea203860d87c0973e6e89dfe5325464600528b8730d55e6b8094908e
MD5 7c0429255cb8a57cb10270ef1a43b7d2
SHA1 304057a228e54aca5ee4b0076b21023f03ff7e3a
SHA512 a307cd643e129940bfb4d5b8d7c102e5d517aedf63efc0780247520114d2b1ace44acd9491780b2673fe495b368ef8ce64462a158c9085465024cdf43554134b
SSDEEP 384:nDiFiZcIdg43sNx8TUNTUlI4gaKMy39w2fLBCv4ikA6dvuvsjtgOIwZOyHUgL/7p:uFQ334wgmm7BCv4w6l2sjXso7
TLSH
T198C24B72ECA8DABBECEA1F85B74A7703DEF01163959C9AD8D9D91C1D009319D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6406ef8579ee45ec3e15db4712b2798b55228d5642b270c7364107fb466b678b
MD5 680b5906b1dc40f5b7414cebbad44a6a
SHA1 a5f722b7b3202db3a70eb7cb98d32079a559da92
SHA512 a5ffb3b116f94c638f9f7ade2e8af91913da664b7633d50bce0a9a8aa7dce921ea33043c1c77af8882220f8859d8a758e7f551f5ea544b03490a0ab100ef0b7e
TLSH
T1EA512DE04C3C5AD1D4BD0E7EB49B35EC95EC9621B8A434392858E9988A3AA1D3084C3F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 803b3f6a2a6c090344e7a950205579e91ac569d6ba7f1232edc8ef0c1f3cfde3
MD5 109e70453a177b5aa8e4705c4d22c7e7
SHA1 547dd6e3563f295e62c8018017863a5732dd5ba8
SHA512 d96ce571e662c2447a674474fe18b3b5b9934247aaa74f1a57319a749136379f8d831a7eb7deeeee13e2e533dc1efd94ab128dec82c32203e4374a9318ef4fd6
TLSH
T125412F59AAFA0148B3B7BF5A9BF6686D483B7D372E06D45D10110D4F0663A40CD72737
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 23173aeb9d3fa5e0045f07e86a6785fc1ddd2e27d369ca8cede829e7b7fb2c0d
MD5 5f7ea1378777067629cfa23ca0e67033
SHA1 aec587106de7ccba92abc1945b7e3fed0875e032
SHA512 91931ebd5ca6bc26885281831ab0727dc66d701e23d286b3a2e2d4fffb87767a567a1e5656e990a4725e593102335ed46f65c73a513cabc7f2f3932f04815650
SSDEEP 12288:ITfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sz:ITfJ4yL/tNCJPXUQrP0
TLSH
T12BD423A761D89446EE7687F81A48E00093097FD56F2BA2E7EE42B4853FFC9161D6C313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 7bdc692b6fad73adb5efee7aa33f9526f49e568667f0a1e6d7811f45a53edd72
MD5 b27b37d763d89c42f68307b26e89101d
SHA1 f03e71ec51ba6e7240d24bbea81e2ec82ee1081a
SHA512 d3f50437db074d6be3250a6f6aedb48bd0f07cb7b47545a7ae3b303cd463d376b9f46f938ca214a92cd0e9c1d19be2a987493bd5c88cb18af6b30e8f564ee4ca
SSDEEP 49152:Qa0h2GEkuAe73q3pp46zwwQ5fJ4klKXnB:Qa0hNYG4JwGfJ4k
TLSH
T1AD859E1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 cf692ef6ba460d7e0284a5f88dfe7c43a873dfc7c2fca31a1570a2763b153193
MD5 a14962fadb63c6ac1b88f3ba30fb4148
SHA1 ef6b60324ee8807b5208a6396ab073c420eaa690
SHA512 666ab783b991fa7bdaa6fbb0e18eda3b9eed85adbd6074f7e78dcca86e14765824d1cfad0db41c725ac63cfe0eb1684145ab68fd6da1600540c58c08553fc7a7
SSDEEP 12288:b/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7So:b/fJ4yL/tNCJPXUQrPX
TLSH
T187C423EB6084948ADE6587F81A48E001D3047FC5272B63F7AD82B4857FFD99B15BC392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 ed71b39e7e9b9ecf108b5e724b32889ae172de3848119dfdf6014a1a7a8f55ef
MD5 fe7c8a00220a7952941ef7c7fa903692
SHA1 4138c4128d37a30d5420999db5e7ac43fafbb836
SHA512 79be54b731c1e849d8fde7e5f0e877bd2c39a9e88318146d027472cb6dd958e0a1370cd85f83de30470250ece7a718ee0b62c36c46e3a6ff8310e31b56ac931f
SSDEEP 12288:UObIA4LWOsvAYFT4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SW:5AL3UT4fJ4yL/tNCJPXUQrPR
TLSH
T13D25F155F69400F9ED6BC27C89A5D512D372B89D0324E3EF07A88A652F637E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 4ebeb1adc7620a7ec9d9e0fd612e4f88a1bec557b5aaa70278ea3672abde3d36
MD5 e4182209665153ae4782cf99c1b20c58
SHA1 61976886a10fe0936cbb814596872195053679ce
SHA512 d5c20eef213cd07e5a4748c13aacc1053f9f101b38baac803823e894c8b88129ee09cb00ebce64e3bbe0e42e371e46794e485ea5c5aa3403a849211b63f26e59
SSDEEP 12288:apFtvO0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:eO0fJ4yL/tNCJPXUQrPy
TLSH
T1DCE4026A32EC10E5D576927C4A85D209D331BCA6172653EF46D080BE2FF7EE82C39761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 db9842fce473b7f032cab653ed1f30070807efa68f063824ede582a9e4f2c9bd
MD5 82527012d26757514959666d29e05917
SHA1 e50f7e6901b3191ac78eac198d6c67ca17ed8cc3
SHA512 f53e03a0d57c7323085ac757a52b452d2f85dd6b028db06b203ee009e3a9bc4fa58571bc9898d806f6c5bb7b4ee73c5778b9cea31244a66da4ecb445572492ff
SSDEEP 24576:I7NM9YqZqmWMUkPjZM48Mv6bEhsjfJ4yL/tNCJPXUQrPM:I7cBWMpPjN8DbEhifJ4klKXnk
TLSH
T15265AE2E6BEC81E5D477D13DC9A28205F6B2B4611B318ACB5152833E7F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1181278512516ea716afb5c91b01fc76b6467eb37c53f4e54f00923499c6fd0d
MD5 44ee0426fcf8e20bc4db36de367a90d1
SHA1 7c3edc2aea7fe1a3a8951a4d9ace8f2a1f2e3803
SHA512 ce3d07c78aab95e46c25476628661338919af5140515c0c83b7a4c6dd3ceca319c858df99057e76a86d6c804de1f391b36c5ffa13b25b7209ddc8238a745a3a6
SSDEEP 24576:XW6BApg2YuyuNDYTabvcdvNYf8km1NfJ4yL/tNCJPXUQrPk:XF2YuHNETovAvNYf8kmDfJ4klKXnM
TLSH
T197858E6A27ED80A4E0BBD2BD45B6D146FAB2B8511B3056CF0255862E1F33AF44D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 9d525c4abfc2912bb97f267fa9ed291bc43af283dff9a0c83673c98281368201
MD5 d7064e5f76299918541db54e7f25dca4
SHA1 bf2756419a276367282554c628569467add56544
SHA512 7c9c5057b7115eb429fae73038171076a2d26d3842818b400d9690fcaa26cc34886f3be615241b59c3e0bff4d8e7871fc5f8faef4d087d6a53c381ac15cff59b
SSDEEP 24576:lAFs06+Omlf8NXEbToAfJ4yL/tNCJPXUQrPc:qFs060loXuZfJ4klKXnE
TLSH
T1C165AF2F62EC00D5D07ED17D8A96C91AF7B1746307255ACB0260867E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 811dbbfa6bdfc5211155ae6181bf4512d7e5be8c3e2a17b5720f74f15632fdb3
MD5 8bf4bca1a1ff96e04d66a57d7b1860da
SHA1 bdd2923478bbc4e85f5a02eebe967b0709e42edb
SHA512 38760b44114888ad071b5a25278c1b1a3bb183421a072c222bcf972368b951f6fead3c19596d56c2cee0feed1558f96deec6888a98a9d2f40533d99f95fc0d7b
SSDEEP 12288:WCJnJ5D3VkrDzxDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SY:nJnJ5D3WXZfJ4yL/tNCJPXUQrPf
TLSH
T17E15D02DD2A810E8D4B7C3B482596746FF72386D2F226AC768B4D4353F12EE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4045316acef0c787f5ea90fb621e630de9034b1e2ede36a73e3f66cd088f5977
MD5 73a190bf906f65be9c684aeb843e974d
SHA1 9e33daae580860d377fe8679907843d03f7140fe
SHA512 25549c97113e231eafa101f4492a3d9c2fad254f7334d43618b1c86cdd6492b3f8d3de12f2445966e8f6b0ea2ebe77078e0ba4cac183fa56f6754ce1fc89d61f
SSDEEP 24576:sEPghm6/7IIXdwcXrif7qQncjlP65i3Vu6fJ4yL/tNCJPXUQrPV:zg06DIKdwc+eQnSt65aVnfJ4klKXnt
TLSH
T19C955C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 bd2221df7f1334b7ad8c758927da2880ca0d5130bfc4fb0e287e81c0fa064692
MD5 bbc29c0d1b06e4288ee6ab7c0da9b400
SHA1 3b40908522c2354aa275e4ded4293afd3ba8491b
SHA512 826e860e5ff59a1a8c3d08b51451c6f91bc8e7c7947529b8a41c6b049855a2d75c093cf2401e05c33211c1951688b17cd74152e0d7c0444afe27b59b7c4542d3
SSDEEP 12288:YEP3RiwNOfBa3918lJl9Xt5JNc105XuqzBRaQhzZcg8xPTE610NzI7S7bOcE9Pkq:ziiOpa392l9X3UC5X7Nr89ge0NZOa0l
TLSH
T1D105121D66ACF0F0D5A9F07C86A10645C733F462276527EF1691823E3F26AE65C3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 ac6cf29ec5bbaea5acbc44175adaf8b8a221344f303a9f55f55dd628e68faf95
MD5 6ec9bee3800dd562a4cfefe9c1aefbe6
SHA1 e43e26132873eb03597500865f8ff7c328b77eac
SHA512 d566ba539bcede249c9b77b8fccca2f1d1027f3f82e5fde1f9f90e384fecb0cf5abc6315e7cb16f22f3e7af80528c3f6d5c3f98745a9fcf2dd7313d7ef3a7669
SSDEEP 12288:0jkyyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:0IyyfJ4yL/tNCJPXUQrPx
TLSH
T1C8F4224A23D4A085DAB6477C5A55D140CB34BCA02F2693EFA580F53E7FBABD52C38712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 b66ebb127e5159a7d623c929a965ff12aa5d01b992c16a5f2ce9b20985d256df
MD5 18b141cca56d5af482c4070377b009d1
SHA1 66dfa7fc6009efad59720903919ffaded377f0fb
SHA512 3f860a2fa641c5e9338effcbd37c6f82f828ea649890cb9c06348c629ee30baeaed106399256595141659efcae7f8b225731acabe360bffcd80046b8d27edd83
SSDEEP 12288:ZykfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sb:IkfJ4yL/tNCJPXUQrPM
TLSH
T179D423AF2095A089DE2687F81648E000C3147ED5272B62FBADC2F4B17FFD99615BC791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 6854c56db3a33ac16afd8a78388e639d0fa3ed4e9b94e3882b4a62315f4d2e6f
MD5 532cbe77dc8829b855feab6e1ba0f27f
SHA1 94eba29e274691484ec93ffc1b28564efcaaac8e
SHA512 f08c58f679bb7140d5f95ef62262ece0c6b4d1d21dabc75822218e361e44bce6024e68fcd7e3642bd73dea040d05fe2cf0b20cc37bf8b7eb43931d6ca97209d1
SSDEEP 24576:fQ9MxZKdcz9dw3rfJ4yL/tNCJPXUQrP2:fVKZrfJ4klKXnu
TLSH
T155558D2DABE9058AE177C27595A250C3A633B4311B35D6CF2448D03D4DBBEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 39452e45c7c9f2289828ecba721e35e75bd1ed36dde7140f4809b288138c3514
MD5 59c1353050d45403d73960486798118a
SHA1 6bcad0da35f3e7b83606e402ee876c7c9ead21eb
SHA512 8960592cbc3e7e63ed6bea26e5dd4567ab47c382902894f94bf8becaa360f299b466dcd44675e862652e2a20525433047fd34187aa5fe12ff969d8c2eaf5e1b8
SSDEEP 12288:syoKo2JRple9pOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:syocDApOfJ4yL/tNCJPXUQrPm
TLSH
T1A3F4E05FB7A940A2E176823C8984C205E773B4701B2263DB6681C33D5F77AE97D38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 927a8eaf29cdcdb0e2e241b6e2b29742836fe7f967464b233868142a167b5373
MD5 eae7cf2dc5979ac65ea57db3f6a1037a
SHA1 61b102fdd3edb738366339b7b0c0e13d1c861efb
SHA512 0b7b6dea979f17fca620304756d22b7048c9afcc8c58274461a0a5b11a4605deb2ca97478c3b0f113fd41b074757bd46e0715c422c5c38ec8e9d4733ab0b306d
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKOfJ4klKXny:60zuNI4fJ4k
TLSH
T118A57B3DA2F800A8D9AAC375C5451366EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 6314cc7731c744c6b0ab376428aec0c306843f49906a87687fa31f9b902038a4
MD5 58b6491ba15b65dc54ff053907178b5e
SHA1 bcce94559fdd59f18eb203e52302cf2193c811de
SHA512 628f174af7810370063f8d34a8bf5fc342df5396b6a6443e28a475d4b72accab6006fade50e66023483398a4ce4f56e2ef73da64aee0a104097ee8c2ea0357de
SSDEEP 49152:da0h2GEkuAe73q3ppj6zwwQ5fJ4klKXnBKa38fXkMZo9gey09l:da0hNYGjJwGfJ4ky38fx+9gzql
TLSH
T11AC5D01E66ECC2B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 92b1cfeaf4667221839a3a48a61e40880b50804c9108f97c75c2dc819e5b2c31
MD5 e0a5cf2734a0f52338e45d826e3025b3
SHA1 6936d5f9506885d68cc0ce600e199d90b9d4f825
SHA512 f3583133b8d03b50673c7883972348c2cb85dff4f9ed49d4a031649b45332351e77e4e907d0ce1161170981db5a0d9d4ef647fea1be45b4a07a9876160e84d7e
SSDEEP 24576:S1QT7EcpfxR+N5AWAz3ooiYhjMqbrOpa392l9X3UC5X7Nr89ge0NZOa0l:PTDxR+N5YzTTjMla38fXkMZo9gey09l
TLSH
T1A175C02EA7F855E5D1BEC5798B238512FA727821033193CB42A0C17E1F6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 14c3b7c37ed5b3e091ed285223c211bd54ec005d9bf306491f6f5f9551997fe2
MD5 7cad2ed0edddccd9c9a077eb0b29e185
SHA1 2c9498154cd2efed26f23ba19232f5dac19e484b
SHA512 baf903dcd73df39bb251d2c5f76f3a6c128083090ae08f24a1dc29ece1d8d309360f7003ed86cae603041b8b96983fa3f32fdde9a94dafa598ce3a2c0e806d1e
SSDEEP 24576:ahbHjP6Opa392l9X3UC5X7Nr89ge0NZOa0l:ahbHjTa38fXkMZo9gey09l
TLSH
T19E05122D15ACF4E4E6B4F17D46561646CB32BD26132593EF2281827E3F2BEE54C3AB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 695e724e5c78c906054be0cb0cb110b71b32e27be49ae4bb91c7635d8dd9cb96
MD5 95bc1f305a74f3798394630ada8e2f5c
SHA1 45b066d04f3d3500252f224059f2cf8a468f6521
SHA512 c48c7c02867eb65c663719f0e75cc5e290572fc4f62fba8a8f68d1c715a6ddc62f984107db451ba22e1089924b7781a55f4d437b23ad487a8ca9dbbd4fd53676
SSDEEP 49152:10K+7mSLBfJ4klKXn7Da38fXkMZo9gey09l:2RfJ4kZ38fx+9gzql
TLSH
T13775127E63AD54F4E57AD1BC96429906E63378A2033266DB0690C1793F5BFE4393DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 73468ee2c5b6dd3dbcf1ff2c75018cdf4ab3fd1beb8094cbf66e58296997a24a
MD5 a2744b0c4df9c6e47dfe5065c9a9f4c9
SHA1 df51449148469e3dfd3325bff35e146e262a3a36
SHA512 c47b9e254fc7f16cdc015926f880076b98679b74f3d93d0a13ce248226a4e05a2d5e5da65d359a3a8e509d3df56842cbf2121c0bab6ae7c837a5267fb9ab92a6
SSDEEP 24576:ARYgnJcRTk4yti+R5dUR/+Opa392l9X3UC5X7Nr89ge0NZOa0l:AignaTk46pUR/Xa38fXkMZo9gey09l
TLSH
T12B65C02DF2B950F9D8AAD136450107B5EB71782D1F209ACB0170C539BF0AEE89E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.4MB
SHA256 8f0badde3c70fdaa632e0a39e6f72a50e6674ea6672f8c560e54888d9be9d72d
MD5 15de4b3e8a459206c086bdf27e1c184c
SHA1 53e0cd957efddbb88392d16f082e84a4ffdf7f81
SHA512 b4bebb3e7b78312e3af1307a7edbdf3e5061e2bf5879d807ec6dd95caea5cd7f88e3a04f464d2b55ebd1b0190582970aa486a96e1fd0b2f7b9ad1890e77e6584
SSDEEP 24576:R4fJ4yL/tNCJPXUQrPjnOpa392l9X3UC5X7Nr89ge0NZOa0l:R4fJ4klKXn7ya38fXkMZo9gey09l
TLSH
T1E165235911E8F4E0E9B5F6BC4B542101CA31BDA6233962FF29C1C57A3F7AAD5883D702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-140-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/404-148-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/404-146-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/404-395-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/964-87-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/964-160-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/964-90-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/964-81-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1032-804-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/1032-802-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/1032-798-0x0000000140000000-0x00000001401F2000-memory.dmp

Download

memory/1032-791-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/1032-797-0x0000000000D50000-0x0000000000DD3000-memory.dmp

Download

memory/1188-431-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1188-164-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1672-157-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1672-155-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1716-207-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/1716-177-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1716-228-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/1716-191-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/1716-754-0x000000000E000000-0x000000000E008000-memory.dmp

Download

memory/1716-512-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2348-173-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2348-469-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/2372-151-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2372-428-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2460-169-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2460-436-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2788-429-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2788-176-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2788-121-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2792-154-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2792-77-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/3420-7-0x00000000017C0000-0x0000000001843000-memory.dmp

Download

memory/3420-0-0x0000000000C00000-0x0000000000D17000-memory.dmp

Download

memory/3420-9-0x0000000140000000-0x0000000140885000-memory.dmp

Download

memory/3420-15-0x0000000003F70000-0x0000000003FD0000-memory.dmp

Download

memory/3420-22-0x0000000003F70000-0x0000000003FD0000-memory.dmp

Download

memory/3420-70-0x0000000140000000-0x0000000140885000-memory.dmp

Download

memory/3420-432-0x00000000017C0000-0x0000000001843000-memory.dmp

Download

memory/3420-433-0x0000000003F70000-0x0000000003FD0000-memory.dmp

Download

memory/3420-468-0x0000000140000000-0x0000000140885000-memory.dmp

Download

memory/3420-1-0x00000000017C0000-0x0000000001843000-memory.dmp

Download

memory/3852-172-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3852-118-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/3916-125-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/3916-331-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4364-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4364-44-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4364-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4364-35-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4976-92-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4976-101-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/4976-98-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/4976-163-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/5052-106-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/5052-168-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5052-112-0x0000000000770000-0x00000000007D7000-memory.dmp

Download

memory/5052-111-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5132-430-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5132-161-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5148-697-0x000001A855CE0000-0x000001A856CE0000-memory.dmp

Download

memory/5184-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5184-60-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/5184-74-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5184-75-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/5184-66-0x0000000001AB0000-0x0000000001B10000-memory.dmp

Download

memory/5652-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5652-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5652-511-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5652-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5652-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5652-510-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5744-787-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5744-781-0x00000000007C0000-0x0000000000843000-memory.dmp

Download

memory/5744-814-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5744-786-0x00000000007C0000-0x0000000000843000-memory.dmp

Download

memory/5892-128-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5892-333-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/5892-134-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5892-136-0x0000000140000000-0x0000000140169000-memory.dmp

Download