7159f4896b3dd9cd3fc20b8e9b100ec38ce6882732bbe9dff6b5ed21b00e7a74

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
Size 3.2MB
Sample260929-stxtssac92
SHA256 7159f4896b3dd9cd3fc20b8e9b100ec38ce6882732bbe9dff6b5ed21b00e7a74
MD5 daf6cf54a6144c8c068bb11b3b2455cd
SHA1 77479634f400e59d08ae2972af384c777b50b9f0
SHA512 290c8c91c72f163e5005f2ef4f6bc8456780718465f3b6db34978b688c00d808086047803e41fd3b45f607616103931cf45917c59ec7f32d1d488f5927605dbb
SSDEEP 49152:Q5d7hBouOjkYu/Ouie5pcnjIx6VwjLfJ4klKXnADa38fXkMZo9gey09l:WBV5cERLfJ4kS38fx+9gzql
TLSH
T1B1F56A12A984849CF05A937447CD9523A9217C010B2CB5FB06D07ADFEEB6DE71AFB21D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3508	elevation_service.exe
3424	elevation_service.exe
4936	OSE.EXE
4696	PerceptionSimulationService.exe
5652	perfhost.exe
6028	ReFsDedupSvc.exe
4376	SensorDataService.exe
4148	ssh-agent.exe
4816	AgentService.exe
664	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
	\??\F:\	OSE.EXE
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
4604	verclsid.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ce8b138f1788cf2.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0001000000009323-323.dat	upx
behavioral2/files/0x00010000000093a7-326.dat	upx
behavioral2/files/0x000100000000994d-328.dat	upx
behavioral2/files/0x0001000000009cfa-331.dat	upx
behavioral2/files/0x000100000000a0c9-335.dat	upx
behavioral2/files/0x0001000000009352-337.dat	upx
behavioral2/files/0x000100000000a1d0-336.dat	upx
behavioral2/files/0x000100000000ba3b-334.dat	upx
behavioral2/files/0x0001000000006211-333.dat	upx
behavioral2/files/0x0001000000009b8e-332.dat	upx
behavioral2/files/0x0001000000009cd2-330.dat	upx
behavioral2/files/0x000100000001b9a6-329.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\CloseBackup.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5104_1385546833\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4360	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7a4d2f12650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000640701f42650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f8a7fef2650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000008d050bef2650dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a353e4002750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{5856755C-9BB8-45F8-B53E-6252FB54972E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
3508	elevation_service.exe
4936	OSE.EXE
4936	OSE.EXE
4936	OSE.EXE
4936	OSE.EXE
4936	OSE.EXE
4936	OSE.EXE
4936	OSE.EXE
6004	msedge.exe
6004	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4556	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
Token: SeAssignPrimaryTokenPrivilege	4816	AgentService.exe
Token: 33	664	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	664	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	664	SearchIndexer.exe
Token: SeBackupPrivilege	6028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6028	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3508	elevation_service.exe
Token: SeDebugPrivilege	4936	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5104	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 5104	4556	2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe	99
PID 5104 wrote to memory of 3276	5104	msedge.exe	100
PID 5104 wrote to memory of 4360	5104	msedge.exe	101
PID 5104 wrote to memory of 3436	5104	msedge.exe	102
PID 5104 wrote to memory of 3436	5104	msedge.exe	102
PID 5104 wrote to memory of 3436	5104	msedge.exe	102
PID 664 wrote to memory of 5752	664	SearchIndexer.exe	103
PID 5104 wrote to memory of 5732	5104	msedge.exe	104
PID 5104 wrote to memory of 5732	5104	msedge.exe	104
PID 5104 wrote to memory of 2044	5104	msedge.exe	105
PID 5104 wrote to memory of 2044	5104	msedge.exe	105
PID 5104 wrote to memory of 2044	5104	msedge.exe	105
PID 5104 wrote to memory of 4108	5104	msedge.exe	106
PID 5104 wrote to memory of 4108	5104	msedge.exe	106
PID 5104 wrote to memory of 4108	5104	msedge.exe	106
PID 5104 wrote to memory of 4816	5104	msedge.exe	107
PID 5104 wrote to memory of 4328	5104	msedge.exe	108
PID 5104 wrote to memory of 4816	5104	msedge.exe	107
PID 5104 wrote to memory of 4816	5104	msedge.exe	107
PID 5104 wrote to memory of 4328	5104	msedge.exe	108
PID 5104 wrote to memory of 4328	5104	msedge.exe	108
PID 664 wrote to memory of 1192	664	SearchIndexer.exe	110
PID 5104 wrote to memory of 1372	5104	msedge.exe	111
PID 5104 wrote to memory of 1372	5104	msedge.exe	111
PID 5104 wrote to memory of 3556	5104	msedge.exe	113
PID 5104 wrote to memory of 5160	5104	msedge.exe	112
PID 5104 wrote to memory of 3556	5104	msedge.exe	113
PID 5104 wrote to memory of 5160	5104	msedge.exe	112
PID 5104 wrote to memory of 2704	5104	msedge.exe	115
PID 5104 wrote to memory of 2992	5104	msedge.exe	116
PID 5104 wrote to memory of 2992	5104	msedge.exe	116
PID 664 wrote to memory of 4488	664	SearchIndexer.exe	120
PID 5104 wrote to memory of 5632	5104	msedge.exe	121
PID 5104 wrote to memory of 4500	5104	msedge.exe	122
PID 5104 wrote to memory of 4580	5104	msedge.exe	123
PID 5104 wrote to memory of 2896	5104	msedge.exe	124
PID 5104 wrote to memory of 2896	5104	msedge.exe	124
PID 5104 wrote to memory of 2820	5104	msedge.exe	125
PID 5104 wrote to memory of 2820	5104	msedge.exe	125
PID 664 wrote to memory of 1512	664	SearchIndexer.exe	127
PID 5104 wrote to memory of 2484	5104	msedge.exe	128
PID 5104 wrote to memory of 2484	5104	msedge.exe	128
PID 5104 wrote to memory of 4576	5104	msedge.exe	133
PID 5104 wrote to memory of 4576	5104	msedge.exe	133
PID 5104 wrote to memory of 6004	5104	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_daf6cf54a6144c8c068bb11b3b2455cd_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://im.qq.com/
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff9b4e9c188,0x7ff9b4e9c194,0x7ff9b4e9c1a0
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,364496438890155483,6477045265723732960,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,17121224650930937755,15903053283843503936,262144 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,14893068658079730809,17272920956578097636,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,9915914865089777818,2976079402933516687,2097152 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,1455234427642235352,4211778400970055226,2097152 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
    3⤵
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,18206169734123237632,3286615504929661557,2097152 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,12631741911889585564,3109121380256469213,2097152 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,3293102021122431126,2454396802329220558,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:1372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,2770911765679452606,13140376244691833622,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,13210490502685465126,13022414066970777490,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17009360825637574960,16648072665913502668,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,17009360825637574960,16648072665913502668,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,2342093356378451820,3481240554468682947,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:12
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,813148238517065870,16261958012654024159,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,11318929138282859040,209018770696700661,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
    3⤵
    PID:4500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,11777175101933887104,10972653805641518336,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,1610722640674956555,12817315068963118801,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:2896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,10350311201445231901,6596176397135873636,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
    3⤵
    PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,16173287874816246383,17798247464423883160,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,3081647274200658308,14861211518621654606,524288 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6200,i,2657748372897791283,8094874500461279658,262144 --field-trial-handle=2296,i,11423574311160240305,9186024462800679728,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3424

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4376

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2648 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2888 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1484

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5c64c9a7aca66621e74bc36459553cccd2389572a1d4169f7208f2008eb925f0
MD5 3eb55f0704cb2c693337745372138107
SHA1 08a4c625cb153b5240e37478b22d7df46b80a612
SHA512 98b5708883a48083397bfbc3536f6995e0cc47e383bfbcdffb4e2c0eda4b3911d59fec97e10844c86ef4ccc20786afcab2d26d640af0c60f209ff122f51cc4b6
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnafJ4klKXnY:t3q6mjBpfJ4k
TLSH
T1F7D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 dd7a959cc973146d5204e1992750bacc8f88dc52e4dc6a45060ee172af315a11
MD5 02fafd92e4244466bf46e734b68e629e
SHA1 7ab53c07118d89a0475454200b9aa3032d1c4672
SHA512 d17051699ae5111f5799ad16c469a60d62f58edea8876e007b905338a21aa9101c7e9d60653ae5f7c7f4e7eff6b06ca1ac9d83967eed824571111f347cd95c13
SSDEEP 24576:KXYfDtczAjOpa392l9X3UC5X7Nr89ge0NZOa0l:Rtc5a38fXkMZo9gey09l
TLSH
T18F25022863E488F4EDA7917CC9A24511DA33BC564374E79B03A48A3A3F237D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 52c4127b39ff61c219b5c222f7f1b85c6df92ae3922faadd97acb4610e75b93b
MD5 7bf0f77d0bdd91061a9d390a2d07d22a
SHA1 bce73a59932e6dc0861ede383c165b22d3acdbf9
SHA512 c4c1c136c73cafec441e31b83c94d5e2e0bfd588ec991986cdc9261a13478f83408e3920f16a816e665bf243d74b4b30de8352f49a3c11e2388193c7667fe075
SSDEEP 24576:90Le5ji0hmxhrMSfJ4yL/tNCJPXUQrPN:9Pji0AzTfJ4klKXn1
TLSH
T18E35AE26F5748335D073C0B9C5D2A68AEA71308657308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e139bff9d46244249117700ad0c7dd8cee26d459c3941a41a8b976d34ee62ffd
MD5 5ee54b3a5594a1bb23060c87805a2964
SHA1 9b71921f183718f70b9581428821f0f065a65a1c
SHA512 930458a8185d4ff1317f2f7a346171b3c8024d9286bb1870f5b52d9cc11a1babffe925b61afe70a65f4ddcdee79977674e29cbd7b4ea2eb6b55c0a9536fab25f
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWj6q8wyusfJ4yL/tNCJPXUQrPO:k/ezSC6vUzPv+Hjy3fJ4klKXnW
TLSH
T11D756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 15191897cffaba8287d21e3c2f7c0677d70054104cd82757c6efc15e72c25769
MD5 2f920195d1bb73fc7f91f5b8710d590f
SHA1 d61029b9e4a3a6f708f91a95eb10545656927805
SHA512 37db68c2e5fbe44fff53de5656a8856a382e3ecd4d04492e2c8fca8f74a05da2546dcdc03d6d80d3ef1fc74ca0674c77c628abeb8e78f2b984a3fbb071a0c610
SSDEEP 24576:hVbqPb88hv/l+BZfJ4yL/tNCJPXUQrPd:hVO88hXl+zfJ4klKXnV
TLSH
T1E1559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f6ff6fe2f2a0c87363f370e6bfeaf1c8306c0fa2044d1c11f155bf839ca297b8
MD5 04e42ae64db91af461698f799a531995
SHA1 92cb2daadd93f7a2d380f1985af3d837d0074c55
SHA512 946a7f0337eef0068c35a16a9506bdb4121c8d2d8fa3c1a3026ba4b556d3d38ccfa77511b783a30898f6d56dceb3e81b78b5411257e8e9e8b9f9bc48a33c7923
SSDEEP 12288:JGBEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:JG+fJ4yL/tNCJPXUQrPK
TLSH
T16CC423E751809486DF6A87F82A8CF001C305BEC5562FA2E6DE82B8C57FFC91A559C353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4adf63c3b4c565be8f865418e7ae363d81dab7980e581f2776c75d9a3edaed68
MD5 27a44682f3f326071e2304537a22bd3e
SHA1 f4183cff33beff29e8b08e9279c07781914771c9
SHA512 3c8c58b17befa4bc80e1475117b11709daf8c024798e95406c4188f6ce7fa8c1740a6b4d0794d5d55056c34af0a2b84fcd8f65d93b91fc38ef7d3d847566a2b6
SSDEEP 12288:BeBNUbTVO86UMEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SN:BJIURfJ4yL/tNCJPXUQrPC
TLSH
T11305C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5c3c63049eb472b8642f9e2853eae85dca9fbd83650e61d6a8f8eacf54b4c603
MD5 62a2f0669d7f3f7301232affb8579c3a
SHA1 40c012174fb63b424a5112498c47cc4764f0c5cc
SHA512 2c34c3fd15e21cde303dee38ea36121a63d27b870bfe309e7b4f73ba791c6b98c6d58a37876aa7183bcb58a8f1ebe112d9d20a09c62142e75eff46ecb4d985f1
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THx:HQvGAdlCEL8c/WRNw5CcfJ4k
TLSH
T132266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1bfb82315ac8c3cd1058476834df7c1387489e04e0d33fd1a3885f5c14db6881
MD5 eddf656c920e29fcd1659d6e8554d511
SHA1 6414f4731446b214e2c1b70bed5d826b90ac50be
SHA512 8e35b067a2d8858098afa6b386da405f0439ccf2af873f5e837dd4a198fdfa1bd7e432103500963f1c458d619e874a5ad500c41341e3720382b6a1244a8bee9b
SSDEEP 12288:sAwSfxL/2Dc3mDLLmt0LDQewsAjWEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yR:RfewsAjDfJ4yL/tNCJPXUQrPC
TLSH
T15615E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d32b95c4588a00097d172b8f2268593d65f07e3e035eeedd1a278be05707f5e0
MD5 f8879bee85dee69ecf6ebf996c421ab7
SHA1 195415715e39d7aa60b467f679592e11f099fa99
SHA512 a733d1097a380672090f7cb0753d9a8fd806bac68c526801ee21c24afa677dba6a151a48e5eea27da5072400828b11cf38d9015f66f4ac8eae891e2abf870943
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHLfJ4:tUEtQevvqc2W1cpV20I32L
TLSH
T17E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 911d7f636fd274befe2d4a54568017eb4409920708cf858e62f8b878fc904591
MD5 6dbfc9bc5334dc3348118d818160ed2f
SHA1 9476b8022571e0a33a28ba2635e9f260d6a721d3
SHA512 236f6a98e7a04030c5201855670c7aabe51a71b6884bc43fa3855ca8006f1096ff16da83ffe2bda48289868664c354bd9a6f1ae28fce9acafc0130a15ea95a73
SSDEEP 49152:7CbRquA/m2yL5zQfFiV+XenmE3/zjfJ4klKXnY:koqtVjnmAfJ4k
TLSH
T1D3D58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 590a841556f27838ad8960b65fe35f9367e901a748758b8cc0ef40a06d4f254d
MD5 ec7a1d3515ad7bdc6970888d6b8e3bb3
SHA1 65d213598e31c94d078ab59cf74e12197f67cc4f
SHA512 0e1ada71f8cd69f0208ae18e2c36345f2bdbc139979ef3c1f16db732eed785ae1f9949594840ea8d8a87c202fe6dcf2bb67095353a5570813db00be55965868e
SSDEEP 24576:ZAhGL6IFoiwtA5l7S53gfJ4yL/tNCJPXUQrP8:ZAM5Foiq5wfJ4klKXn0
TLSH
T1CE359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2f9387070d2b9d48533f8e82ea46e85856b195710be17452898daef08d190531
MD5 2c3569a23f543fd9af16d4a73877682a
SHA1 6041abcaee69008661fc295873f717784724b786
SHA512 667db4ffb32e679d0890853c926c72076c43d8f594b165f318bb15ca49db59c9459916028f190a5e3eca7ad6d9e1f88fae998f39581c766c3bd89a0b5271a3e7
SSDEEP 12288:rmw5HEjsChNEBFgl0WDm+CvEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYx:qwuROWXfJ4yL/tNCJPXUQrPR
TLSH
T1F205F14A32E41CF9E96782388687D132F7B2BC422A26D71F5760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f86b08aad4e8a50adab7b967817c5c31e1917b06f04694f8d932b5331ae8698b
MD5 141e26010c4200988f8455b910c84c10
SHA1 a76111fe4b4b0889420377a9efa674918b50c108
SHA512 7f6e372674ef2bef7504c0b35da0a02fa6509e90303c49c440f5daa45c2939b3699aed6f413244f8a46f86152a97d04fee6ca280f006007188112d69325328ee
SSDEEP 12288:GyZ1IymEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SF:/ZuKfJ4yL/tNCJPXUQrPu
TLSH
T11CE4129B32D460F9DAA782BC89D4D101D3317C92233A53CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b25bea6259d08802efc84810680e6f579dc3c209f2f40a6142652d4e83116214
MD5 09757fb733fccb98a333f689e6888001
SHA1 e00313d0cd71f7716272354d9246274845b9e40e
SHA512 7fea25711314547d63192f78f3cee78fde5082701c730676d9e88bb616111aa8c419340a52ae0a8f4578e7f22c7975031ee871ea13c6f1089a82407eeb66f352
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23U7:AQRQyi36YOcPDLvw2gAf+PN3FfJ4k
TLSH
T13D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d4e9d55800f7f446117e7ca156ad7ba2e9d3b573567e9af33a7c5c9dcdefeb64
MD5 7233bd590eabd22355fda633cc2a3d26
SHA1 b0b47e6cab951f0f7f30988e3d876e064440c2e9
SHA512 eb69f4d000850fc5630d6fe842b6091ea6eed91750ed2f75e01c145b9566f55372d609a541deb0ffee512a5452cae7aefd8b6fa4ad4b9f55a25a33bad7372223
SSDEEP 49152:Gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UV:VQRQyi36YOcPDLvw2gAf+PN3FfJ4k
TLSH
T120667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7647addd18de50b9c75a02c733c8a11f083936fc361484183e9995121e65e1c8
MD5 04355a96f94a2999d25c67415e517641
SHA1 f5491124dd143930f5497634c3c6fdf242d097b0
SHA512 30d8365841716225643a9a0e515d9ac9143bb28f198aa49e4617ebb8a104dfb4e0dde287f6b87b801084754e96e62dafe2876799835d0bc69b389dcec50809bb
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0afJ4yL/tNCJPXUl:668Qg55nhkeWu7PNU3/TfJ4klKXnC
TLSH
T18CB55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4e691ee27738547b1f92cd42d0b11b504e3abdb42a28fa3118c900233dfdc371
MD5 d9d9dc5f6aab843066711ddaa17956f5
SHA1 59b92232018c05fdcf101ef7467eb67ee3731ce4
SHA512 ae8e04ba2ef5d47073ef4c43c3236ae2b165a1d947307aa97d71459bff36cee9cb022a443fb1abbf7482bbdfc2b22290b7c11496ed477f1f231a1f9505e8d5e7
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99J:Ry5112gYy5azzVvU69nLKnhZ+fJ4k
TLSH
T16F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 feb847f148ec420fb9cc454447550de9b8639cccb0b30d2888b45212111027f9
MD5 2a99e8c8e156af0d8cdd9cfbfe6f732f
SHA1 953a489575f3022b3fcdd45c2434285d3f021543
SHA512 fa5e5d4432f23e1c2548402f4264ad32991568dd67cb70d89bd3534c6461c7163f745d5b95ed4bb4f94f397fc304bbec4a923eeb797bb4e564fb3df591e45e4e
SSDEEP 49152:KB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gldfJ4klKXnS:Yu6JmIxd2ddfJ4k
TLSH
T12FD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6934ea1fd250eb8240633c5f970037b3a9c4446509883a7c7c99ddd1ab0e8adb
MD5 734d01d86d448f1bb696a1a939d610e3
SHA1 cc175c917c907f041aa12b91ed7d1c12bc15e44b
SHA512 666d2de7bdefc609856d421b1404e171e01d862de69d813b950944243200da310842bfa5ae7dc33c81a22191d09628ca0f7b91d391e6fcffb0873c5fb8ebf01c
SSDEEP 49152:h1hpsNoJpF1A67U44CwH7R4xxfJ4klKXnS:hmifPqRAfJ4k
TLSH
T1D6B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5d0af7fe5ce852d4ec58a97d7c907f457fc6f91bb46a8fe5727ec9e53b0212f9
MD5 85cf0ce20083811378c4f360b08acf45
SHA1 449ebb97e63b78d086a18004488960d0f9048c50
SHA512 3c646c1f81e6e5b8f638842a848a0f12d166383474711fea3637a51a3ab0018fb8a635edacea48973edd562cad5ae0e47b414bc7bbe7a8f89b3ecc9de8967686
SSDEEP 49152:XSuZQIY0Be2KkRVtOnks6NMHqKfJ4klKXnf:N5dKqi61KfJ4k
TLSH
T150C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ad053a6918bfa563f5e81ecef400cba016109401b2a960e3769a6e0b72a9772d
MD5 82093c6050348c734b2f9e41c5a491ba
SHA1 bef25327bc8caa9eeefd81aa26d94497aae9dc07
SHA512 e59588bfeeba584c3250de86aec23687884719d5d2f74765fe00031b2940883c9d7a743df3c49f26261c35c36d81644654e8006ec231623062b992273053783e
SSDEEP 49152:FhtSn8EApI0figjgiDn0AP5wNfJ4klKXnO:0X2iWphkfJ4k
TLSH
T1DA95BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 6e4614f25e2985788d20884c4b4296300c221a1be5b0dbbcd6735baa650861fa
MD5 4a0216c22c601a7092b2a366c8df56ab
SHA1 395797d10e14fccb7ab88128f996da4809d8c5f6
SHA512 b9320e08c57ca2fa904185ab9469d8d8d02452f1c8072b3ab48f278e8f5032d30a49eafe49313500ad5612d8ce22dba66c3416143256d167df5faa0c0e7e01c8
SSDEEP 12288:FZEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:FWfJ4yL/tNCJPXUQrPb
TLSH
T1D6C423AB60D5948ADE5587F81A88F001C3087EC6672F62F7EF42B4417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 e0035d8dd75316b8468a5ab00a491ffb94f1a896f0936a773a24f4bb88425b02
MD5 3860b83358e718737d501feb82f75426
SHA1 3725dde0e1731b3601fc762ef3488cd554253cd0
SHA512 dd4e14c576230da54371fd3201d3df600012fa789f0f5d89c42d85e2d249562a50ee0c085017546279a5949835ad75f2a1d23c8ded57672138ef9b8329d477fb
SSDEEP 12288:LCEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S2:LffJ4yL/tNCJPXUQrP9
TLSH
T197C423AB60D59486DE1587F81688F001C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 6487b9011d43a081007b87bba11b64f16ba5de24f517649378cf6c6c059c44f1
MD5 7d5aa618b430baa92903f7bc167eb20f
SHA1 5d357de639c74e01633d706c4d56f5ff1500a2bb
SHA512 0f69990faaa0238447c9392e666df0dbaa05d7bfc0950ed2e622a8d37adc540a0b11179602ff5ebc814f482a777ba6ec97349b0a60a7c40d5350adef07a726b0
SSDEEP 12288:qkEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7St:qpfJ4yL/tNCJPXUQrPq
TLSH
T173C423AB60D5948ADE1587F81648F001C3047EC6672F62F7EF82B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c57220d250556e881b46a8112ab867f6bd23d62eb94136821194dd23b1261634
MD5 960d1a9b226249ff7a9b9ec77c9623b5
SHA1 3ebbfd6826f41ea55a74dcc205e2982c8057fac5
SHA512 304dfca003be1a822e23a415e1638e7692c4ab7be24f8c4ee2e02da00b877e026b358a03cc965a356386df477b05fc925106e0daff0694072d57ef8a36aabd3d
SSDEEP 12288:jVzEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Su:SfJ4yL/tNCJPXUQrPJ
TLSH
T11FD4239721D480C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659296C7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 559ef40bb4bb8d88b831350b4398443d1095d24ab54f9400faac458cb2245b79
MD5 f510e8112692267fb7ea0aaed948f1ab
SHA1 a7e4b0d82115eefa84c97ff2b2fb60f0428a72aa
SHA512 35bbff952b94ee94fb725a5ca96eae742dc37e6547474ad0c0cfcd67fc0df683b70bad455dc28949c62599ce2bb45c6bd64d3cb575144160d12cba5ac2652519
SSDEEP 12288:m7EfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:mIfJ4yL/tNCJPXUQrP9
TLSH
T1D5C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 ad6e43223bbb36369bc1701975e1af65caad3ac99115c4fdad6c8b3533cb8a79
MD5 33c803a1ad14b39d40f99461b6eed87f
SHA1 0a1658ceed7695ddfc2e8136aa432435a89da819
SHA512 8abf6b40908153d81393938b616ead107b6a381425cb7b18e7fc1b817923488b893a9a69fe8db7dfcb1d559d9de1e1faa56876ab122142b2752129c919a7f868
SSDEEP 12288:LuEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:L7fJ4yL/tNCJPXUQrP9
TLSH
T107C423AB60D5948ADE1587F81A88F001C7047EC6672F62F7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 10aba05128c826a655038920dec4aa52c0e5b9f4f205a3f260576ba21828df69
MD5 99a3f10cc848cc6376c45eb856acb837
SHA1 67d072dc6aebcaa09d99edee2b59539930465d14
SHA512 528c820333d57a5d2fd0667baecc4152801b3cfa1b13d714d32696c468f665e721bcd5055e4cc7caf1d9e7ca17f27238645fd753e076bc5e10d5b36251a13c34
SSDEEP 12288:ZKEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:ZnfJ4yL/tNCJPXUQrPf
TLSH
T1E7C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 f9ca7665fd4e61625e17d578a06f9e872bc8506ff8f94e4a04fd58c987ec49b2
MD5 974562ab6529919814cca5c8dea9c04d
SHA1 1bd4ef0f6f7c396fb33b346d683bc74c1e2184ca
SHA512 6fae0ddf52f8185f3cdec6eafb5f387c8c3ebeaa44f891f24ba75d12de00da17bc5bf838624ad7cc6eceb7bd1f192fa1d1468d7855c8a2d9848b062aed8bcd1d
SSDEEP 12288:UiZwbDzzFEoS2cPvyiEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SX:3ZM3zFVSO/fJ4yL/tNCJPXUQrP8
TLSH
T1460501A5B39018F8EC67827D8954D902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 093517c8bfe63cbb79e3f1bae10189933a9969c8fcbbaad6169fbbab04980cc3
MD5 c0ace723b10b0384b45a347d6937a5fd
SHA1 a349c1010cd98fdc302199b2221d74243a40ea7b
SHA512 824c9b373b8ff571cd73c48454cdf328cf1e2a045ee982b5b6f5d84701c63ee75b047a2739129c8b0c9721815c2f86a30e84b6cdef2a1fade91b715ece62aea3
SSDEEP 12288:WNEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:W6fJ4yL/tNCJPXUQrP+
TLSH
T1EAC423EB60D5948ADE1587F81648E001C7087EC6772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3a5cfcd1caa15b51f2b9fd0020b0dcb77a8fd84f70fd30df563f4471267ae71d
MD5 2e7805135307e4ea96e08699b4a58302
SHA1 b27e7eca3b0e42f5a7dba35fc5212cb6eb42baa4
SHA512 ffaec94c9c5c98f035c6cc9887e877a988a0293e989e1c6c02116c098b717aa57502f1b528e53bb3c57e63e96e8af404328404781e557fc1e6dc060fb0e03f56
SSDEEP 12288:0REfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SM:0ufJ4yL/tNCJPXUQrP3
TLSH
T164C423AB60D5948ADE1587F81748E001C7087EC6772F62E7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1ac4f981d3ed40cafa6dc9ab7b68b9e5b9b8a355b2b01b60499137535f1b61cc
MD5 ea0856f091c29102ce7f6759eb22473c
SHA1 737a301d7b292f897eaf6045dc51f570505945f8
SHA512 6ce3289a7c9072ada3224ad6d5f1e65fd9b1eb567cbb57102927b3b01e9f07b48cc4921da00fd81cba0b852f04456c6829645d64119897bc24bc7964adf171c4
SSDEEP 12288:yyPz5L8mEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:vzyzfJ4yL/tNCJPXUQrP5
TLSH
T10EF4125732A130F9D53682788990A502F331BCB2072587EF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 8bf9a700502ffc1188547fdff98c9cf780a6f4b490728d2bf708974812d069f8
MD5 30d9b8c3dd84adcba44075f246381ac9
SHA1 38e0c181120aa59fea2ab5544dc23cd96573652c
SHA512 1a2fa737b951aad26085a1f91653ce7fb388f58b73ba7d095c0b3442e88452a6b3fe786d0204568a2b4757f67d5583338c11fc9b84fd6459fcb0bd1a5a999caa
SSDEEP 12288:0NEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:06fJ4yL/tNCJPXUQrP/
TLSH
T1F9C423EB60D5948ADE1587F81A48F001C7087EC6672F62E7EF42B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 0e428e6476d59e976bbc9e2714a90de733025a6fffb0ad22d980110dfb680c52
MD5 6359ee13a6c976be570395a2fd9a412b
SHA1 d14caf050db8ca422ce49b2c7f3ae160bc799dd2
SHA512 90c9acef4baa6fbfaed0a6c4d1a5de3539877bf412dddb5530d7bf3fdc75570b952690a5eefb13afe1b52b0323a3c818201836087c0dffdaf91b91d70e19f0a3
SSDEEP 12288:oNEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S8:o6fJ4yL/tNCJPXUQrPP
TLSH
T128C423EB60D5948ADE1587F81648E001C7087EC6672F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 f86ecf0535643a36c931a6379f9087a7fc644f3737e29647c2c10ae95d499215
MD5 a800595e609ed1c01870bb9e26da025f
SHA1 239d92c82e4d2ac40d7cbf1c139b882ba7153547
SHA512 2b4180e389c4b4a16437c9fc4aa76b796778555d4215ebee84d0d5bad8b55eeb5512d51eea7f83bb36f265dab51495f76061c1e37193a7bd16b70a774b135dc5
SSDEEP 12288:tyPz5L8mEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:EzyzfJ4yL/tNCJPXUQrP1
TLSH
T19AF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 d499827ba73afec02b78bc24f2fdbe53a04464e2b2e4299ec47a992f8b554f22
MD5 7e0fa4c0de05ec7a2ddbdc3224693c5e
SHA1 755539907c002ab9d7cbe84d6e6a62036def8368
SHA512 1b7a8ff4a636a7dd56846fba593cd985f0aac54c0f6c15730bb95bb22e7e726c68f0217b17e347780f589a6a46bdd54b600b132e054280932f26fbfdff6f0a1f
SSDEEP 12288:dCd91WYoaLHF3z0z04PDvhUEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGY+:IT8aLl3z0zD5fJ4yL/tNCJPXUQrPe
TLSH
T1B10501A9B39018F8EC67827ECD549502D3B27C9A0770C25F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7901b85a27e2b1b48ff7b056e823b09907ee3e88870ae030806ab690a221cea4
MD5 7d08f0343fb5dd2d2c42b528981d9e0c
SHA1 bedd45737533a0cc9b9d8449bf306010eeda3726
SHA512 89c8f0a2f2a66bac437d02e71503ca516c2a61629fb1ab0c1e22101ba3a8ee630a8e797c80d8c28623160c1534c860facbc3a6484666627dab0e85873eaa3d16
SSDEEP 12288:3i4e7+RdTfgwCHKy7GLbbdIvXEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GE:33rd9CHKy7GZlfJ4yL/tNCJPXUQrPc
TLSH
T1E725CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 ea99c26ec2608bedff836c1060a9e05a17953d835316dc365d6ed95a1b91b341
MD5 fb415f05b610f71e3e486cd4d9cbf53c
SHA1 eed735f969c8dacdacba3990067f955a637d6245
SHA512 9dd0168fefea63cf8d918c872819819fbbe009340f3cbbda00bf7a15ead7b6ce4d0e4a930b2b6bf2faac755e99cf8cb53832d8cf1a73818d799e76502fb96114
SSDEEP 12288:IEEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:IJfJ4yL/tNCJPXUQrP6
TLSH
T11DC423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF82B8817FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 62daffd81c7fe355868c8f496ff95a06dc36d0e04e346ab17d792c506762aefd
MD5 f60e2644065cfcc17b6ed10416d32732
SHA1 53d1239738bc7b74662f0424631197a8462684e0
SHA512 fd2b5b6deea6197f7e63aeec89ede1adb2dec216b702ce3566f6de77f0142f319e419408e482804ee321632133686786ca65484826486c6c05cf9ce0db13d1fb
SSDEEP 24576:2twvrk9RX6wkyAIefJ4yL/tNCJPXUQrPJKOpa392l9X3UC5X7Nr89ge0NZOa0l:zMnYIefJ4klKXnBba38fXkMZo9gey09l
TLSH
T14A850129EADC84E1E1B7D27C89A74606F6B178591B31C2CF029653AE2F37ED45D3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e748dcbfcd61f228c19cf7aec0d556c4f56b7afb2de00ea20c2e961e9a93ad62
MD5 8274bbe192e4ab0c242663ff36f62a98
SHA1 666ecc93ce9a3ba972510c99f8fc21a7ddf87790
SHA512 ab28e69b233855b29f5c2fb948d4d741405b2a5f29986bf949a43646f6304213a15ce00144bff84175b114840286fc2ad9640aa6907bf675f8f746ee3b8eea46
SSDEEP 49152:HYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tfJ4klKXn3:qySzPlfJ4k
TLSH
T1F6066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 20ef342f67adf41e30fc42ead09fab7d68477639613ea66cc7b1fd66e61b9173
MD5 a6e12089408f5dcdc8fd9a11402e896b
SHA1 f34a1b58cf9e365dacaf5534e1bdbf49c4613e10
SHA512 40bf17e122ed12942501a2b2da799a4b34350d6d301dee94cafc64a27828d6370b9055103be0441e6fba25479186c258a87a5809cd75108eaa4f88099bd213cb
SSDEEP 24576:s47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYvfJ4yL/tNCJPXUQrPI:s47JUQjqirIhCnDHUPfF/dfJ4klKXnQ
TLSH
T1C865AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 14a51a52735744ef9b1cfbbd0c3e1a40796371265e8bb6de24ec4b61f66b64c8
MD5 b24dcfd7fb09ae60f94882efc0692525
SHA1 1b07cb06a7233319b6006ea003de83a8d51c8bec
SHA512 fbdb8344cae454d1e48294ec3091c9839165e7f85c7a06f8758fa99e3692abe7179b93b0dc950ccc9cb97ee5755adef48a9fc4eba23a011bcc970ca26f21fcbf
SSDEEP 12288:Xpsf9EfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:YKfJ4yL/tNCJPXUQrPe
TLSH
T1C6E4015AD29841D8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 49c14588dadc3aa48b17abeb1bdd5b5a878950616d0ff4e4e14ce312713815cc
MD5 fb070ccbebbd0cdab35f000e7da8cbe8
SHA1 9ace9680236dfa519723e792c69e5ba10a4f96ee
SHA512 3d54839efb3caa6b362473ef399baed213a70f714faa43f82f2bfa12ca3001bd2d60736fcdc9d2668696bf0721a3daf75a670bca3b0784a0803d1a7686af13cb
TLSH
T19F71FD40C7A05A82EFAE40F7A5F25987357AAEB354474D830BC8F5B4EC12F5614F8E58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59df89.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59df89.TMP
Size 3KB
SHA256 f102134645cea9ee8092a5633a72ca787ca37152c36212bd34ac8f212ebe3b64
MD5 8d3624876dbf2acf56f9150f29e57f68
SHA1 bb279a2236c4aaf21239812a96742de3bdc71f71
SHA512 4c1f552d1ea483c84fd5695bdc587866af72739fb0c015bb6ebc7f11ced117d84d1f729aae712a4682a36375d1c29153ac55ea149c7014fdbf488738098fd9f1
TLSH
T10561EA40DB806982EFEE40F7A5F2598336BAAEB394474D9307C8F5B8D842F5614F8C48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1f28771f5cd9d09506ef22af23b2824a5d329c1519d6b2b57ca556cea97d1be0
MD5 f1b19618ff4457df453b3a6b57725a0b
SHA1 426b57372ff44d279e6753e7c388bec1237fb8ca
SHA512 fc4afdcbed6e532b40417282f15276f3d0be373c5a1727f476ac05b5d549cb63373cb361d6df3f8c81fd3ab7a2da49708a79f518c372e1849ad4db0b322afd40
TLSH
T11161ADF383F8866E890156F4E6186E2BCE5D0915432C7C9AC9E4AE1B93F3871D180A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0743ae2f0366bf41e321d8e125334ab6b311be1036a3d7826fddd21f46d50ae1
MD5 17e0a3592e9686d731e93a497c2f8926
SHA1 2649d09838a397c4b97e9b3cd2ca8f5ee846ca87
SHA512 5ff9e92875bc343182c7b332da3591e69e63a5d8d55711594dc500a9ca2d6e95b7545cf21e34bfdf2f07bfb0d5b19bea06bcec322f71af646f058294dd943fad
SSDEEP 192:sxRFRzCG6/fpspbVZvcNvzoA8pZd/g6+WNXS/9YFViGRnIgDOwJ:sxRFkV/fps9bHn/5o96nb
TLSH
T17C42D655EE28A97B9CC7E21DBB557F53E3F91032A1D11E48A6FC8A1C01E76DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b111893afd22413faa80eb037e4ee757d7b36bdf819706cf269473e3c7efce4a
MD5 7fcb93c652a262f5243bedb8224e7a6a
SHA1 13078a70debcf67be941d254a415ec3d22083f9d
SHA512 9a1a7693866a7e72d52e2efccf4e8c5dbf7fe9a0875c3d9f44130c7f5e612e619954005bf4e5459be395a79d27a6cf08946a5d05c566b9e203289658b9cf3aef
SSDEEP 192:sxRFRzCG6/fps5bVy7UDBzoA8pZd/g6+WNXd+VYFniGRnIgDcIJ:sxRFkV/fpsNg7UD8n/5MVcnp
TLSH
T15442C715ED28A97B9CCBD21DBB65BF53D3F91032A1D55E48A6FC8A1C04E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 848cab7bbdba09675931df7944d36d1be390f3b9b69a417535446bb96f453800
MD5 a3407f5382414e54c4de81e01d5853e3
SHA1 d3f529c0a6a3378ec10f8818a6cf3dc7d06ab5c2
SHA512 69d2fab41c1f1fd3919d812ffb8d1fdbf8211b775c93b464e502ba96369733ee9e6e4c63b8148c03b2ac17424322fdd84768fa626f2da42bed12f8e82e97ccae
SSDEEP 192:sxRuRzCG6/fpsjbVy7UDBzoA8pZd/g6+WNXur/YFxfiGRnIgVIJ:sxRukV/fpsvg7UD8n/50/Azny
TLSH
T14C42D815ED28A93B9CCBD21DBB65BF13D3F91032A1D55E48A6FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 8154ce024bdf8c8818d6dee87617f1950555e8c47af5818c06c6e115b4a93c54
MD5 80d04832b39d7381f4f62ec6e1c4b23e
SHA1 b2e6bb1bb49e4dfc86e3ec15c9f572b28ca0ba0c
SHA512 6fae76deffffe20e90f769d18d1a33767938d13336a4f988554544d8a9b0566984d6d032aad35b3489c4ea01efbb23f264ec2dab1c94c98ef758133bdd17721e
SSDEEP 768:+l2P/q7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVD0a0Iro+PgG:+l2P/CEbDKWgwef4eu1jaAh0z+gG
TLSH
T185C2D97B740CCA7F4F904ADDA8197A9B6DAC02CB9698CD8047FE941C03C77EA52164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a51cd339-d396-4814-bc8f-3e2a863ccc2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a51cd339-d396-4814-bc8f-3e2a863ccc2a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 61384bb724cdeba2054ed5e648de5ddc574a0cf343e57e59566c098050007307
MD5 460c0bffa8e95da2b4eeaea000ab875b
SHA1 bc3d227452ded1eeb49a76218b47360e6c8ede1d
SHA512 30b0a62769ebb11807e8fd38f7cf3bb921c71ca689364f04a7c4bc4aeee339ca56434cd850347482fdc28e0c57066182a83e0e6a3daa878c2c7fd7fa56fb4470
SSDEEP 768:gs3ypLGGf9cBqFyEMbxyJugQVTJ7vvmeXCh2sDq:gs3yp5AqFyEmxyJJq17v4h2sDq
TLSH
T1D0F2BE709875CCB398EB9241B746B787AFF405A398CA5B88D4D99F0E01477ED170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 4caf9ac06c40fa1ddde347e568dc31be53cd639d6c7a1d8d81665a2f10ce58ac
MD5 71e23404310cef02ffd16edb0245af3f
SHA1 269e9243e868e938c1aa71e2520120eac2f8ba58
SHA512 33f934681cc351ca9c0592639a9b77b127db3f8a5abafbb10caf7ccdb53234965b3eb0428dfaf7571671f14694e93cbf5a58d5e6c7c11e41c409d83493128e8a
SSDEEP 768:UFWP3AwgJpLGtki9cBqhyEMbxyJugQVTJ7vvmeXCh2sDq:bP3wpOAqhyEmxyJJq17v4h2sDq
TLSH
T1CE03AE35D8A5CD7BACF78781B745B747AFE001A388CA9AC4D5D95E0D00876ED170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 0ae2a5bf3f20ff17a94298903fb54a15c065997c9295c0a1ce0dff6166f2d734
MD5 db687894b193b680ed338282336e6544
SHA1 a0de558b9276536d59d7b3fb6da3fc1a18cb11cb
SHA512 475aea54da2ff98f6a785b2b73c6799c357c8434a3268b395df956222ae361e9b6d655e45877e6b6b0673ae753b3eade8d0c1e92aacf2de891fe3c2f16d4272f
SSDEEP 768:p/UxvxjgC+k3s2f9cbyEMbxyJugQVTJ7vvmevCJSHtBk:cZj3+k3XiyEmxyJJq17vMJSbk
TLSH
T1FB03C0359CA59C7388F792843649E787EFF505A398C62BA485DD6F0E128B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 01a15356f70f8e58867fff6befaaa1438e931eb47f029f5398590901873d64e5
MD5 974693eb649d02f95d30fe2b52b7ef7a
SHA1 c0e3802a1754f8b2d9ea82c8c70d928ee23022d6
SHA512 c17ca446a982632a1e7b643fc8646639accf51f5974c067fd74f2fb8e1d30d6422496bb1922525c129d9f77ef1b871d2c82e0db3c718c7c69e157adf37968c1a
SSDEEP 768://UxvxjgC+V3npL0Gf9cBqiyEMbxyJugQVTJ7vvmeXChE77:SZj3+V3npjAqiyEmxyJJq17v4hE77
TLSH
T13803BF34A8669C3398F79244734AA7D7EFF405B358C62E98D5D98F0E05877AC170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

9308fe85-2e1d-4d2f-8976-330db148546f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9308fe85-2e1d-4d2f-8976-330db148546f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5104_1607280647\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 ae55e73185f1d1acfc3373c2b0d9242fd08c655cbe8e5f42d817a1086213b428
MD5 56d0581a83193886c5ea123e1a7a6521
SHA1 d184e78ce4e1cddffb8c803feafcc0466d530fba
SHA512 b2410c7905ed87efb7881c695b97d4654cc4b73c95d8fd768d7ad6919c22f3439eb21f663bf8e21dec7439d86c630ee40150b81b3d2bfa9ecf43dd97cf09923a
SSDEEP 12288:IM7lEfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:JyfJ4yL/tNCJPXUQrPy
TLSH
T1FAD423A751C49446ED7A87F8164CE000D309BED51B2BA2E7EE02B4817FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 48e71d198fb415cd057b6e9fbda864f401d35e488c578ac87d1274c89ac3ff46
MD5 733152c909099763592b9362409531c7
SHA1 987e317e1fb7e931f9753757292bbccb082fdfef
SHA512 a0801d158bd5c473aeaecabea228b14d342e61dec50e6be5460f99de5890e3dc333d4eca5964364fd8ef324435bc8147ddb7111d3b713a3514df432931984def
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYsfJ4yL/tNCJPXUQrPx:Kgb4mBIBhGFvfJ4klKXn5
TLSH
T1BD65AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 55557074c84dbac9c4e9683fea2bd633b2d9d6736d4239849068a098fd598672
MD5 3d1d5d3f7cc6917bfcc5488f4774d926
SHA1 30964a8e83b9d398e6b0a7a7615860e5cadf252f
SHA512 5dcb21af0cff3db68d368c648952fa896f0b1873557797c375ccffcb685b9e81aee75abfc1232fbc42c2db6375c30a357f89372d37331297653600af640514a4
SSDEEP 12288:RCGktQNOfBa3918lJl9Xt5JNc105XuqzBRaQhzZcg8xPTE610NzI7S7bOcE9PkBI:IG/Opa392l9X3UC5X7Nr89ge0NZOa0l
TLSH
T1A905232850F9F4F0DAB8F5BD46652652EC337E62133855FF0590853A7B18AE1983FE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 100759c8fb7d61fcdd82b0bcd29a2ee324ec5d4169a5cfef27f9823a4d78e782
MD5 225cd3b3de78f1846ef9526ad9e3a179
SHA1 7c098d4eee36ee4292b17f896d3adb324d2bedec
SHA512 987322ebd73c6a91fcfa53c784f37a4789218a46f152a746677b054060e5c6ed90407a5afff1cc88b80d9ead53eadab113b1fa5611c0459ccc627caa6708153c
SSDEEP 24576:xG88u8FpJqH1vzria7/m/fJ4yL/tNCJPXUQrPC:U7ZFPqVya7/0fJ4klKXnq
TLSH
T1F135026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1f34f64718fd8f51ccb91ef2ccdaafe9b397620c0072a580e8f3b3008e01820a
MD5 1c7ca411889c10b2d723b0a1f32ce04d
SHA1 a04b1206099e15479e3717416fec4046dfb748c6
SHA512 73550d371687073c4d4bd10534d0c166412141a06d067d9549d15efb391abe0766a56d634b0cb43f8040e6d8a3d51740e894b345a15f2a5e10f4793744842c32
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7fJ4klKXn7:zG05lO43bGfJ4k
TLSH
T172D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6d95bbb02344cdfed5d20ba69b98ca3c09f9efd7110d8ad4947c954c72c420d0
MD5 b0aa08838d5814e71b10f32946dae62e
SHA1 719f05a92234dd0e9b0b20b50fef159242afddaa
SHA512 dd28d3dd5b46c8115e88bb758823b87b2e4058c9d3fda03fcd4a5e28d94c624877244c53c99ab0807a615afd59a80e5ab91862af21db8791bbc13b674e873d33
SSDEEP 24576:ifa5POZ3dpyWVM50JicR2hG0lasx2+47eidntfJ4yL/tNCJPXUQrPz:qa5POZ3lJt2pasx2+mTfJ4klKXnr
TLSH
T1FA65BF5EA6FC00D5D579D17CC583861AF5B1346653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 638df4bcf129d76b3b0eba5908ab197fd844a8521259bf5482b1f656f3fd532a
MD5 c4e66d6e2f14fc8fe1176180945284c5
SHA1 d61c08ca9b9c8bc43998de9cfee336d8dbc9175d
SHA512 3e977496ad962cda6fbfd3afc4e11922f2465ae0bd9b6789e5a503c658da378b07acb51dca973bd861eea2d6b1150ab0c1df4f7f39dd1b9eb05048f1771bb7ed
SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7Fk3fJ4yL/tNCJPXUQrPS:3Nc/zEOVHFUfJ4klKXn6
TLSH
T1F9858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 b0eccdbc62992825da55a92bf01c14780bb121e40475edd425d896a1c2b61dd9
MD5 f0fdf3143e8cac99a6bee73faa78ac97
SHA1 ced135be20acdc77b344ef3168956372aa8d1155
SHA512 e6f1d71696f8c4d136e27bd2c28cf24cd4bb0518d29266472b4c5555130e8aee6dc8c0d3975133c0f98a5177e40e09ada09bd6937b583f5b9527c2923f32df9b
SSDEEP 24576:76DIAOpa392l9X3UC5X7Nr89ge0NZOa0l:76DIha38fXkMZo9gey09l
TLSH
T19625021C237AA0F1D1BBE07D86930502D572B972836659EF0694C57E7FA3ED8B83DA01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 f7e8d71e8b713b17bd5787eb3a6b3a98e51e13c5e891b76734b2fc15fd231726
MD5 15a2e3e4b378822f32ed93ff5dbd66a2
SHA1 573c8c54cfa82a5c2eb509fb00fe12e764cce240
SHA512 0d9c86c10e25c09ad4f79cbaa5eac1f07a4217476f6ac6e70ff1374f0a9c8435ab8a05e7ac07bd41f0a56d86ada6aa96cb459ce341212dd2243b2442dcad4737
SSDEEP 12288:jG6kyMtuNOfBa3918lJl9Xt5JNc105XuqzBRaQhzZcg8xPTE610NzI7S7bOcE9Ph:ytyFOpa392l9X3UC5X7Nr89ge0NZOa0l
TLSH
T1C415120052A8F4F0EAF8B57C8A621291CE32BD22577552EF5590963F3F39BE19C36706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 cc838614427f250321f40b7ffdc71ed0974a71b74e825835c2fb71be86a0151e
MD5 0c1a2454e7739cd14e4b4ab0996827b2
SHA1 e1ed4eb1bd8bd7f33183f62926866dc7835f0f7d
SHA512 243aa225af1ef54ba9cd3d87cadfecfd74fc8ed216bc0dc888e92d6f5055c56ccf9a6b12eccdd7c4377bc65c9b28359ab2fc722f01a346e243955a46e8573fa7
SSDEEP 12288:/qst5NOfBa3918lJl9Xt5JNc105XuqzBRaQhzZcg8xPTE610NzI7S7bOcE9PkB56:SiOpa392l9X3UC5X7Nr89ge0NZOa0l
TLSH
T18D05231450A9F8F0DAE8F9BC07652B51C833BF67137954FF6590867A3709AE2883BB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 034385da027b2bbf40f2eaa5e51f829129b66069be0f86dd887445185ff0c23b
MD5 a5f31b666775689d8a1b551de04ff7d9
SHA1 baa15b93e5618edd19bb263ea9e87c6c5941a40e
SHA512 9047bc5b85a4a59a8a1f62a6c230af7385a8f077855f25d851df053bbd46c811a3c90216291cb1d67b5a331edc0944fc5933f22fff5ef410f8d85db81b0dd7c4
SSDEEP 49152:Qgb4mBIBhGFvfJ4klKXn5da38fXkMZo9gey09l:QtkfJ4kx38fx+9gzql
TLSH
T1B7A5D01E22EC01F5E1F9E2B89DAA4417D6B278160331D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 7b96304505b751eb519bb4261af1666d33313f28b377e9ff2dac45cf6f1595da
MD5 efb6e1a55378ceeff12844efa297d3bb
SHA1 39dd208d199dab39dd6c45eb0db7e82648376c25
SHA512 a34cddae427e857859cff7a29aed4451bc705e2c70d2d37ae01115ebe78305c1afe5b583c308acb61cf6bacb3c9ce377774c15d6fe7287f48b58dcf878e2ec40
SSDEEP 24576:JTkNvNnaFeYhJNtmZBmmOpa392l9X3UC5X7Nr89ge0NZOa0l:JTMwBtOmva38fXkMZo9gey09l
TLSH
T12D75B02EA6F855E4D1FED6B48E238512EA727861073253CB5390C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 911960520a91333563fff0ad25583335700df5bb88466a13bf586e76f650245c
MD5 87f4518c2ea06863ccbfc17b4ecbf221
SHA1 55dd116e1c7aa0289f2ffba4ee2963a3db7a8e9c
SHA512 46781cc5bef10509a2b6db36705851dde336daeeed9bb6904d82b76cd8790d7f5f2a3f55a0e3124cb945ae4ff0674d34e068b254309b4be0b1c0226ff95b7005
SSDEEP 12288:nHvUrBFrEjwaQ+EfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S+:nPUr+NQrfJ4yL/tNCJPXUQrPV
TLSH
T17E05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 81aa1ae2f00171da652902cbbaf71f80564717c9aafb660f8b77424c1de9b1e3
MD5 cdaf57de12236eaddfdde7d3f1662289
SHA1 eb7db8ebee0095fbddd0fffa3d17dc034a08e7af
SHA512 a165a1f017beb4f6b1cd0b9cbff3114c2b009cb22c1c84a715217eab7b05b64da4c2540b2a74d7d3030c08f59328cad3db128aec86209ac58e570aa860613d1b
SSDEEP 49152:XDVHeBIAA2fJ4klKXnWFa38fXkMZo9gey09l:YfJ4ki38fx+9gzql
TLSH
T1C485027EE69C44E4D57AD1BC8A535602D7723CE9033665DB069081BA3F6BEE42D3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 883a00dd05191a6284295fb167d4861c7d5d316430a056022f1e224fe3b57587
MD5 ee71a5629ebfcc28e5668beeb3b470aa
SHA1 a3d4e186cd16eb22d94a1a1ee65051b7a29ccdcd
SHA512 eac08ad18d9dc6d299ff10c2071b4ff43728189872b33315d1db496e537e5745a42f8e2a97ab77ff96cd45671a617bc84f4028c760011a8651c471c2ea9d7161
SSDEEP 24576:kJnJPbzB4SnOpa392l9X3UC5X7Nr89ge0NZOa0l:kJnJv6Sya38fXkMZo9gey09l
TLSH
T1BC35F13CD2A860E4E4B7D2B8811A1756FE32387D2B2569C719B4D5353F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 44c45c3eeff24a8413451d511e8de195d4d2ce0d64df1e77152103b2d4ae06ce
MD5 73387f8a0cada48923a609720cb45e5b
SHA1 bc05d501db44844379e51de813b09e30eb607044
SHA512 cfb3032ca89bac1b9c34acb659af4aa5be1292e1f0cfe932e2a4ff326e89f8e3015e533e4556f82243a14ab9cf8de016c212ad2d0f745319672599b770d5da0c
SSDEEP 12288:x2thNOfBa3918lJl9Xt5JNc105XuqzBRaQhzZcg8xPTE610NzI7S7bOcE9PkB5El:xUOpa392l9X3UC5X7Nr89ge0NZOa0l
TLSH
T1A805231040A8F8F0EBE8F8BD57663A51CC33BF5713B955EB6544467A370DAE6883B209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 bbfcef8f04d988f456c62da251833609bbfc7c96cb38ba820431131d8459997c
MD5 59d0eff4f2e9f9294baee34ea0fd9d9c
SHA1 71ae1799e44699f726dff9c7869822c661ba19c0
SHA512 81e2268865df586b4d5615a80043e4d6daa6af711b6f3371e396c517975dde0de5d78f22e85df867cd8c47206fc89b1f147f08f3ccac92c6bc0f3a60fe3d8046
SSDEEP 24576:y6UqjpbOpa392l9X3UC5X7Nr89ge0NZOa0l:y6UBa38fXkMZo9gey09l
TLSH
T1E015121951E8F4F0E5B8A1789A6612258832BD7313B955EF32C8863E7B35ED1883FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/664-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/664-484-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/664-156-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/664-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3424-48-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-56-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-396-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3424-54-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3424-394-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3508-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3508-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3508-36-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3508-30-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3508-37-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4148-119-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4148-121-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4148-455-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4148-127-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4376-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-107-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4376-445-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4376-443-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4376-113-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4556-0-0x00000000016C0000-0x00000000017D7000-memory.dmp

Download

memory/4556-14-0x00000000037D0000-0x0000000003830000-memory.dmp

Download

memory/4556-22-0x00000000037D0000-0x0000000003830000-memory.dmp

Download

memory/4556-9-0x0000000140000000-0x0000000140885000-memory.dmp

Download

memory/4556-392-0x0000000140000000-0x0000000140885000-memory.dmp

Download

memory/4556-1-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/4556-322-0x00000000037D0000-0x0000000003830000-memory.dmp

Download

memory/4556-325-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/4556-7-0x0000000000CE0000-0x0000000000D63000-memory.dmp

Download

memory/4556-68-0x0000000140000000-0x0000000140885000-memory.dmp

Download

memory/4696-399-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4696-72-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4696-74-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4696-80-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/4816-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4816-139-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4816-147-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4816-145-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4936-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4936-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4936-66-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4936-314-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5652-85-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/5652-431-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5652-84-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5652-90-0x00000000007D0000-0x0000000000837000-memory.dmp

Download

memory/6028-442-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6028-101-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6028-616-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6028-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6028-95-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6028-614-0x0000000000720000-0x0000000000780000-memory.dmp

Download