dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Size 6.7MB
Sample260930-kla13ataka
SHA256 dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f
MD5 317c1ce217ae98b230a789544b786a3b
SHA1 2a674173b20d74dab79310cfcc83e64f05a1a545
SHA512 d15d8479a4fe8c94b3e4d10ae178905ddac5f1ab344c2d958fbede946641eaeadf72a175be6ac2334600a6df7abe1cc0ff2462bf37ba2e1e9da4d61380416312
SSDEEP 98304:3pULdlyjls7bf66D6n2kvW6HBfEqAqlDc54oNbmHsZm/VK3JTnfJ4k:3CLdlo27bfhaBfEqFx4mCJTfJ4
TLSH
T13D66C002F7529179EC9350B6697DA72D242D6D316B5108C7C2C47EA96FF4AC02E323AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware bootkit defense_evasion discovery persistence spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4172	elevation_service.exe
1632	elevation_service.exe
4744	maintenanceservice.exe
5932	OSE.EXE
2540	PerceptionSimulationService.exe
4176	perfhost.exe
916	ReFsDedupSvc.exe
236	SensorDataService.exe
5320	ssh-agent.exe
1252	AgentService.exe
2808	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	OSE.EXE
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
3484	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cc2c4b22612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\msdtc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\vds.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\vssvc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000931d-334.dat	upx
behavioral2/files/0x0001000000009398-335.dat	upx
behavioral2/files/0x0001000000009cd5-339.dat	upx
behavioral2/files/0x000100000001b992-338.dat	upx
behavioral2/files/0x0001000000006215-342.dat	upx
behavioral2/files/0x000100000000a0cd-344.dat	upx
behavioral2/files/0x0001000000009354-346.dat	upx
behavioral2/files/0x000100000000a1d3-345.dat	upx
behavioral2/files/0x000100000000ba3e-343.dat	upx
behavioral2/files/0x0001000000009b91-341.dat	upx
behavioral2/files/0x0001000000009cfd-340.dat	upx
behavioral2/files/0x0001000000009951-337.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6124_1309235447\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6124_1309235447\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6124_2029884154\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6124_2029884154\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6124_1355347711\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3340	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	IEXPLORE.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006204d47bb750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002402a27cb750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d506747cb750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a846df7bb750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1e257b5b750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{DB02DBD8-2664-4A01-B23E-E8BA66D19DF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
4172	elevation_service.exe
5932	OSE.EXE
5932	OSE.EXE
5932	OSE.EXE
5932	OSE.EXE
5932	OSE.EXE
5932	OSE.EXE
5932	OSE.EXE
3384	msedge.exe
3384	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe
6124	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2876	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
Token: SeAssignPrimaryTokenPrivilege	1252	AgentService.exe
Token: SeBackupPrivilege	916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	916	ReFsDedupSvc.exe
Token: 33	2808	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2808	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2808	SearchIndexer.exe
Token: SeDebugPrivilege	4172	elevation_service.exe
Token: SeDebugPrivilege	5932	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6124	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4588	2876	dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe	100
PID 4588 wrote to memory of 3388	4588	iexplore.exe	101
PID 3388 wrote to memory of 6124	3388	IEXPLORE.EXE	102
PID 6124 wrote to memory of 3184	6124	msedge.exe	103
PID 6124 wrote to memory of 2204	6124	msedge.exe	104
PID 6124 wrote to memory of 3340	6124	msedge.exe	105
PID 6124 wrote to memory of 2204	6124	msedge.exe	104
PID 6124 wrote to memory of 2204	6124	msedge.exe	104
PID 6124 wrote to memory of 3216	6124	msedge.exe	106
PID 6124 wrote to memory of 3216	6124	msedge.exe	106
PID 6124 wrote to memory of 4372	6124	msedge.exe	107
PID 6124 wrote to memory of 4372	6124	msedge.exe	107
PID 6124 wrote to memory of 4372	6124	msedge.exe	107
PID 6124 wrote to memory of 2668	6124	msedge.exe	108
PID 6124 wrote to memory of 2668	6124	msedge.exe	108
PID 6124 wrote to memory of 2668	6124	msedge.exe	108
PID 6124 wrote to memory of 1252	6124	msedge.exe	109
PID 6124 wrote to memory of 5984	6124	msedge.exe	110
PID 6124 wrote to memory of 1252	6124	msedge.exe	109
PID 6124 wrote to memory of 1252	6124	msedge.exe	109
PID 6124 wrote to memory of 5984	6124	msedge.exe	110
PID 6124 wrote to memory of 5984	6124	msedge.exe	110
PID 2808 wrote to memory of 5176	2808	SearchIndexer.exe	111
PID 6124 wrote to memory of 5764	6124	msedge.exe	114
PID 6124 wrote to memory of 8	6124	msedge.exe	113
PID 6124 wrote to memory of 5764	6124	msedge.exe	114
PID 6124 wrote to memory of 8	6124	msedge.exe	113
PID 6124 wrote to memory of 4660	6124	msedge.exe	115
PID 6124 wrote to memory of 4660	6124	msedge.exe	115
PID 6124 wrote to memory of 2644	6124	msedge.exe	117
PID 6124 wrote to memory of 2644	6124	msedge.exe	117
PID 6124 wrote to memory of 2644	6124	msedge.exe	117
PID 6124 wrote to memory of 4840	6124	msedge.exe	118
PID 2808 wrote to memory of 2384	2808	SearchIndexer.exe	121
PID 6124 wrote to memory of 4252	6124	msedge.exe	122
PID 6124 wrote to memory of 4252	6124	msedge.exe	122
PID 6124 wrote to memory of 5432	6124	msedge.exe	123
PID 6124 wrote to memory of 5432	6124	msedge.exe	123
PID 2808 wrote to memory of 5384	2808	SearchIndexer.exe	124
PID 2808 wrote to memory of 256	2808	SearchIndexer.exe	125
PID 6124 wrote to memory of 4796	6124	msedge.exe	129
PID 6124 wrote to memory of 4396	6124	msedge.exe	130
PID 6124 wrote to memory of 3264	6124	msedge.exe	131
PID 6124 wrote to memory of 880	6124	msedge.exe	132
PID 6124 wrote to memory of 880	6124	msedge.exe	132
PID 6124 wrote to memory of 4376	6124	msedge.exe	137
PID 6124 wrote to memory of 4376	6124	msedge.exe	137
PID 6124 wrote to memory of 5016	6124	msedge.exe	138
PID 6124 wrote to memory of 5016	6124	msedge.exe	138
PID 6124 wrote to memory of 3384	6124	msedge.exe	139
PID 6124 wrote to memory of 2320	6124	msedge.exe	140
PID 6124 wrote to memory of 2320	6124	msedge.exe	140

C:\Users\Admin\AppData\Local\Temp\dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe
"C:\Users\Admin\AppData\Local\Temp\dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe" http://bbs.360.cn/thread-15667307-1-1.html
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://bbs.360.cn/thread-15667307-1-1.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://bbs.360.cn/thread-15667307-1-1.html"
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe077fc188,0x7ffe077fc194,0x7ffe077fc1a0
        5⤵
        
        PID:3184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,4014805683907313122,16571248215550996292,262144 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
        5⤵
        
        PID:2204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1656,i,13522381396100052249,11377395413332553839,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,861121306424097837,14961467111468674395,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:13
        5⤵
        
        PID:3216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3164,i,6242628571202507967,3038492292282010650,2097152 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
        5⤵
        
        PID:4372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3168,i,8067597849079755715,16656721672843125798,2097152 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
        5⤵
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,4442350372281455018,16367777007398336652,2097152 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
        5⤵
        
        PID:1252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,16803830454093393484,16125616153383450312,2097152 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:9
        5⤵
        
        PID:5984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3160,i,4152100736100185072,6373500909275777847,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
        5⤵
        
        PID:8
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,15845555201614716197,5446047986749326754,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
        5⤵
        
        PID:5764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,10072010413340197334,6511449281620863184,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
        5⤵
        
        PID:4660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3826705627471873875,8513981728296641257,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
        5⤵
        
        PID:4996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6280,i,4550004504597989227,13993493388744805267,2097152 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
        5⤵
        
        PID:2644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,3826705627471873875,8513981728296641257,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
        5⤵
        
        PID:4840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,99628254860733384,8305479824243133273,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:14
        5⤵
        
        PID:4252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,15367146981717737084,18189934340733025907,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,6077021984695287586,9807071155895291955,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
        5⤵
        
        PID:4796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,13915859285470349648,9635376972058219076,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
        5⤵
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,3828286725386681531,3423665840678233607,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,8580475587650574959,9848805654404458199,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:14
        5⤵
        
        PID:880
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,1217508316378361865,14552984610957661976,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
        5⤵
        
        PID:4376
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,10630691116157298506,2642445570596561311,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
        5⤵
        
        PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,13616163415184728795,9873041169156976932,262144 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7995560979885478746,5991040392833985172,524288 --field-trial-handle=2608,i,8673140905105281785,11128285005329883480,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
        5⤵
        
        PID:2320

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5320

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:796

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b77535f6c5d70b178c973a566fbda6991a83a9f2b165bc63991ca6971364f997
MD5 214461ea9f83180e828c9da8ae6390ad
SHA1 30440e633dc32e2132d3edcbbafab7df7590f467
SHA512 959d352c33793e718aceb8f43f8c6b83fbf1eaf60d8a589bf520e8de32c4d8aa55862a935cb077fd8cb1b97b48b5f684e06ea4d5e2737cca49d8320366cb2fe9
SSDEEP 49152:cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnYfJ4klKXnh:G3q6mjB/fJ4k
TLSH
T19BD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c091fa89bcabfbf6fb7183287305677eb020acdb2b587659cc806d2495489c85
MD5 ebcd20ed614a0f98364af2f33648fac7
SHA1 8ccb4e1e9d9833b9fed7d2ae1714d73e9322c426
SHA512 ce654ed05df02669e72892e1c4f946aec05bb5c194468d05e972aa4255efdc15915420be17b210b855cf9c1518e7bd6a555228e6e3b39c318c503ed0e45dd5f3
SSDEEP 24576:6XY9DkczATfJ4yL/tNCJPXUQrPemaKngL2jdshRTdG1YxITqvfPkbIcbjLm:jkcWfJ4klKXn2marSj8RoTCCW
TLSH
T1C175122AA3C049F8ED67827C89A1D401EA337C854765E38F07E099692F777D81E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 8b4b78bf9300be4d4ad89127d997df67fc2b93d9344fa7de2070f6f2384ca09a
MD5 123d9c8b64e35bd44f22b70aca65ecc0
SHA1 501de252ef63ce5afba2601a83c9734b419ff4e8
SHA512 a8ef92f9c2619d4de59ef3350bdc1c7dbbcc431e164b54a364fe547aeb7fe7a243cc457cb27503f712f9b62bdfb52af7fc0eb2df5cced8ec687bb85488638134
SSDEEP 12288:d1XLsswWkxy2lRq2czATfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S1:TXYfDtczATfJ4yL/tNCJPXUQrPe
TLSH
T19305F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3bf2ac3cfd76caeeca54a088d5746aa3947e6b00ca3c6093c916c4fed61a7bba
MD5 9dac8ad237b040ceeaf130de53cb7873
SHA1 6c7703b665fb3f7d765ea3167848f4f75685928b
SHA512 b81024e6b30fe47e57303f51fa558d181fbfae187ba35443aed079eebc86ac5e404e1967757a53f867f6c6c2233fae886477478d7d8d40d00d50185dae34d841
SSDEEP 24576:b0Le5ji0hmxhrMQfJ4yL/tNCJPXUQrPV:bPji0AztfJ4klKXn9
TLSH
T1AD35AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 71a96fbc2c08b577e931958327701a6afc4f89ab2ae5755387857c13cd314251
MD5 50551f6c38a70495706f86779772692f
SHA1 fa2d0afe6dfc0f46a329182818f4349f0d51d677
SHA512 cd1d5493b78c32cc152fdc0dc1b11808a40cf07a9434b79ec550628d6e01528ede1c4c8825aba4ddc9b60a7cceecc1262e72b514c9f33f16f68a4f46b033c13b
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWj6q8wyumfJ4yL/tNCJPXUQrPA:0/ezSC6vUzPv+HjyRfJ4klKXnY
TLSH
T1DF756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d111a98315dc1e49be2f78f561dd19757448ca79042d0774006637d60b593d3c
MD5 1184003a8fd55028bb32282525d4f749
SHA1 6cef0cf80cd9907b97277a42c5044fe7cb712069
SHA512 5f1232ea65630de1bea4c56abfac742353e05bb23e7a22784d444b876663ae74711d93036e7801b266c7da1be2dfc73135259cfde2b720696edf3998dfea58e1
SSDEEP 24576:9VbqPb88hv/l+BPfJ4yL/tNCJPXUQrPx:9VO88hXl+NfJ4klKXn5
TLSH
T1D1559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 e5d2cde7caa255e7a4939a24bb8e9b055f0e0e96abed9d07611352acfe3b74bc
MD5 0022f554615db727b6f22265a4cbecd5
SHA1 7be167f73b16fe2b7d031e33c4b041e21271d407
SHA512 41db4f6af8fa565cb4e65b08e32e2157f133564734ad42a71b9a66c26799870513931984e990cbf02c1844981955291b189e456f3b1b92ac12657284bf72fafc
SSDEEP 12288:eGcfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:eGcfJ4yL/tNCJPXUQrPd
TLSH
T1C9C423E751909085DF6A87F82A88F001C714BEC5162FA2F6DE82BC857FFC91A559C363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 3b8b8b84ab18066a35cb35fc96ba844fa7a26284122847ed0fe823226fdba8ae
MD5 f7d032562ced44b1b33465904975b34d
SHA1 5f6bad717df91a58b113a1f2ceb5e3a66f580556
SHA512 e0afb12852cc6bbaa00cd464255e4131d7e9e19363cce460885985d5863673e6a9675926d91f788b2077cb8d643cf139ab6092958606929eb052eb0e72630f8e
SSDEEP 12288:JeBNUbTVO86UnfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:JJIUnfJ4yL/tNCJPXUQrPB
TLSH
T15005C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a560013d78a1455fef90df37c59298fe030181f2300aef139c17edcd795c3aef
MD5 ec72277f0ceea103b6896c4b1ae35260
SHA1 e7b3013514ba50cdf25a3964d5ad1aa310c9a042
SHA512 6330bc06782671dc1bd5528c23bcd9e1d7f155e4967ad0bf9e2e969e67c11f9434262f86e00cd194af167edf801b316e98710c4c1d5005e3c07e758261b0e0ea
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:pQvGAdlCEL8c/WRNw5C2fJ4k
TLSH
T152266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 94468e4d9d4c20bb07bd34b7b875eb7730cc13fe61ef468f3a2617b6ecc45367
MD5 abc4fcf532264366633224367790054e
SHA1 0fe99a846823cd9754c468a9ca8e8bd49eca9ae5
SHA512 9a77a637b581eaf5ca04f819f4307b934ed197af8c6bafc907df8f044d08b8382a46866b52a6599176d02d0642a6fb681927a6c5a1c5d89f62080c1fbf39c07d
SSDEEP 12288:ZAwSfxL/2Dc3mDLLmt0LDQewsAj9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW3:KfewsAj9fJ4yL/tNCJPXUQrPV
TLSH
T17D15E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0b1a8bf8de70315662d6d51ea10f4be101edca829ae2f9e63fd149c8c39282c2
MD5 523eec5c70c3406ebcb85e07fcf821ce
SHA1 fb987173ce0b733c43eeb1973aefaca7f848810f
SHA512 a33c4aa3c65d26e8e1467fe5de65fa8257205d249edf9b51fbb8ef3df75f202d752b01e460e22d851f45ba89ffa618b4a0781ebfcc102d09336728fed1e9ab46
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHFfJ4:tUEtQevvqc2W1cpV20I32F
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2c41a9c013b3243fb38fc8cd873c5b11d0f531bb7150d6f998e574981b63bf0b
MD5 c3c9a795f9339e5e31b04e6e725f8e83
SHA1 63a860f2c6f214958106aa349131f4872389aa94
SHA512 aff3d48b22eb017fc050d08bdf2d3e91eef0f29ee04cdc21c9d8f1fe9013a967544acbcac404cf4becfc5759749965cc08b4c621f6b182161d761508b8502868
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zdfJ4klKXnh:9oqtVjnmqfJ4k
TLSH
T1EFD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 abfb9c54f203cd3783e72551506ea584c1b010b8cbb884f6869f174b18783917
MD5 ca3cf8acd288b6d6ab0e62632b735da1
SHA1 3866a2e5f613ba86a0ce8c09e95dcce8244abcf0
SHA512 c0184fcae66b49161e95ceacefa79ebecd3fe1dd8ff6b368b334af97ae27463d9866553a1553444158d9fea47f8dce68d3d65f0ac308009d7586ae229a2f5eaa
SSDEEP 24576:hAhGL6IFoiwtA5l7S53KfJ4yL/tNCJPXUQrPg:hAM5Foiq56fJ4klKXn4
TLSH
T1B0359D81E7F955D4F5B3AAB899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e3db58f66634f04c8bc45ffa46490c200d8358ac065386a0e7e01c2c0ca4aded
MD5 85b26558be302931237e7c0b74d418ee
SHA1 b8f85d86b0f450e9aa510b478aedd3a2971cd4b2
SHA512 5d0f0be56fc1ebc7298d36315bbee7f8bce9393395a3c6ee369436ebf02892d39aaefe7dfd6c9016fc06110848aea057196a64bc73d2f76b5fcd2f20a36ad44a
SSDEEP 12288:2mw5HEjsChNEBFgl0WDm+CGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTr:vwuROWxfJ4yL/tNCJPXUQrPH
TLSH
T18E05014A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 f07984826b067ca8de30a4533960dea63b25ce00eae661731048cd4b57b0bb1b
MD5 86b9d006e1c0f51a1282e13930ea02b3
SHA1 b61b0b31524ebfc8c4f191fc888d753869292aa9
SHA512 e081cf320656b43040781f1137357a05776a222c84853abd181db4a59b0399ccce99f267cde0c6dbbd22e7abdb1b793ff78d0ffebd94b817fd02e577ebb40d9a
SSDEEP 12288:pyZ1IyNfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:AZuofJ4yL/tNCJPXUQrPg
TLSH
T1F9E4129B32D460F9DAA782BC89D4E101D3317C92233A53CF5A5195963FBBAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 74e794490bd25f8f5a0a690d883cdf37c49799c8fe937665fa6d16e1f9f9a208
MD5 02e697cd96ac9f8654981b95096b3456
SHA1 8d951989745fab6965b221597195061207d7f03a
SHA512 4142008fac9f497ec44e6aaa577421869218a4b91f98e51c6beae17b943c754aaf03bcf78f48b9d638b42a62bd9113f54ed7f38e2dc43a0f76fed160a9260fd5
SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UK:NQRQyi36YOcPDLvw2gAf+PN3rfJ4k
TLSH
T170667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5b08028ff22b334d0174c13d4b0a23c804c220af7fa132610f1d23eb7bc83939
MD5 110a5b81ec3ee3e35be3cde39afe491c
SHA1 0ac853508d54e96e7484ca59ae14d1b34191ab02
SHA512 3eab8f3db26cdc901110b38ac2d2bc9d04b5d39898adf565fd7f15b78c77dcb2dfcc42019ee1fe93d5190d6b839ba22e803f779457cce1c26735edd0bed5371e
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:SQRQyi36YOcPDLvw2gAf+PN3rfJ4k
TLSH
T151667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d0be606153dcae5f7035c4331fb4ccccc85af77c1da4b12187b361de271248cb
MD5 5306391c21ded19eefb9d7551d181089
SHA1 43a91c8cc5d11523a7cd3641ebc3b2718dd8701c
SHA512 f073032fb799f5f09e10867335881e7bb1f413b0c8a5d6b1094ff0aa737dba21d0da132cb28f2bffecec7eb1148430f844e31ed415527a20f57868a6210caaa4
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0YfJ4yL/tNCJPXUZ:P68Qg55nhkeWu7PNU3/tfJ4klKXnW
TLSH
T1D0B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6dc85302ec21ae6d5020c597746951ccd26d7ef1fa56fb6f85d1d3ca86cc3355
MD5 2fcd98871c1c54e303d7a7c6ebf3ebb8
SHA1 b3e06548c195307207a133763b9351acb3c7d14f
SHA512 02598b775b5a170501554e3aec6f744195916d62bd2641e3fd8d65faa7541d93be17ecb2b617b45f20a80aef649478b1d8b5aa1c5eb66633af3a46c42edf2fca
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99I:my5112gYy5azzVvU69nLKnhZcfJ4k
TLSH
T1B0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3b00dab47e8a17043e684c9ec16638f7ccbfa3f34db5b9855431196eabb52cab
MD5 0cf7e6ecc2645f1877f294637f548cb9
SHA1 4ee94e121040dba8d19e00ede7d8903f30a3028b
SHA512 5c9bbe32c8618732a239f7345321928364b7e7fd37791dbba53fc1111cc15c1b59ce66164804b301ae3efdb0bd5731a686a7f7bc8fdc797e02385af29a0b8328
SSDEEP 49152:UB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glDfJ4klKXn+:Ou6JmIxd2dDfJ4k
TLSH
T1C0D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8e6e39d2362b1005fadf13df3545ca79681f259ee4323d3c4092ea27eee89b54
MD5 980959cd9a9a307338341f428358a3d9
SHA1 5c3c45a24a761841b92f66dbbf5d325ddb2dc655
SHA512 ebb2a3e3e1f10ad228a846713c68af4a893274ae1822df2262264e2f3a4ce056f703b40a143216182de7b8992bfdb00613624c5e0a611a3e25ff709fe9c081ad
SSDEEP 49152:R1hpsNoJpF1A67U44CwH7R4xHfJ4klKXnc:RmifPqRqfJ4k
TLSH
T114B5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 acfeaa5dae51973cc30f10e81270aa67d38d32ebddf61e53cf46388d6f9b3e20
MD5 2c0196c33653568b5979608d5b840fd7
SHA1 8e9347417977182459fdb547b6a21761ce9bfddd
SHA512 45de0e6a7621f124fd45543c9ceb57f7b194d8167610f2973211f57322f61ec1e1ccc7237d766f1e4af8726a1b4bf7c0f8d19d497ee7ecfc4ee4c45eb6ac06ff
SSDEEP 49152:zSuZQIY0Be2KkRVtOnks6NMHqofJ4klKXnH:x5dKqi61ofJ4k
TLSH
T19BC5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1d0c0902c5a9c66fc2157c62aead8f1e2c1db759381e6ef57ee70b5cdc5c6a9f
MD5 f192d4e075c25fbaf96e04e02b5df5c7
SHA1 d88dae2fb75c57bdaa07f5e87ec8be8f40d4db6c
SHA512 2f0add4ddbf36dbfcc305f467aead10a50277b2ea2bae811b455d4083444f9f73b3885513c60c423c5e3c452c5df0ff09d9f50efd5a34a7062a3ba8385a1ef44
SSDEEP 49152:chtSn8EApI0figjgiDn0AP5wTfJ4klKXnG:dX2iWph+fJ4k
TLSH
T1A295BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 bc668708fed3239b346a813b2aa292d7baf918631418877a38f16a7c1fbcbd09
MD5 d8537eda441bf65b42746081c41d563c
SHA1 149814cb5d106fc7b58acff137dc34e2e0a6b4b7
SHA512 59494f226603f33b6b2d92f4996f6b4955d07c3193a1622b06ef5b7b8fbc0fb5ef098853115be90d2a234dfe404f0c2021e03cd0926d68cc73c3dfd5ba40f86f
SSDEEP 12288:O0fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:O0fJ4yL/tNCJPXUQrPd
TLSH
T103C423AB60D5948ADE5587F81688F001C3047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6427e32ab0d05652281bb9a2fc3817644ea5b43916dab01b8d4c29857c15c95a
MD5 4b842fa03eb6b177a609fa05e64a4bf6
SHA1 adc0a0c4f71855fba7637530200146247a56e58b
SHA512 f192e60b36b8c3be18078776caaeab90307ce210b100aba55ac77f93d15aa9b42f52b169d3f60eeae201c79635a34db1aef8493bf61361e9ecd948bc9faf9d27
SSDEEP 12288:QZfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:QZfJ4yL/tNCJPXUQrPN
TLSH
T132C423AB60D5948ADE1587F81648F001C7047EC6672F62F7EF82B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 20e489167f9b5af068a638622e778a4a53da1a43667696be3cb0f1620b7ecb6c
MD5 054718238b51efd7e73742ff3e721306
SHA1 2f4207d0057acb0dcede2b64fcb91a23797c1d4f
SHA512 4ca144871b3fb01647d7d2877f70b2c3a6d6c5bc5a63545e5f82023e4b05fb78d77f8e0809a8f71ae168de446c15e64f18160f15241597e2d416eff9f18d3b47
SSDEEP 12288:i/fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:i/fJ4yL/tNCJPXUQrPN
TLSH
T1F3C423AB60D5948ADE5587F81A48F000C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 89c3b1e77ece5b6d14c0b2765b06045a27ce7db1967ff1c953eace814804c8d5
MD5 d7411ca39dcaad7e99afafa72f301290
SHA1 3e08142eaa00e640f49339e89982b15c626d3748
SHA512 62ebbfcfbbbaa22bc899ee52f3308dc6ce5e3b49c37b9b44c1694b0d6447b4904757c9e42a5f1ff1bf4895e4929433d8dac1f67c43db5687e72de06968f14c6c
SSDEEP 12288:bVqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Se:ofJ4yL/tNCJPXUQrPd
TLSH
T167D42397219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 c1e21e3de6a5949c9b7426b899d0049b00cf69fbc8451797bfe8907808ed84fa
MD5 3e088bf9b1fc1df10ac7acc7f5c469e5
SHA1 a543ab119bbf879ab3e11d66f7b9397d313ee4ee
SHA512 78ef9cdae3f48b23935bbed56d7cb003b965c87f1ea41ee1d745fdf70a38fe32426893e9b8b8e3c8595cf1dc5527821ede24ac58f38f0e97f0317c2f557615f2
SSDEEP 12288:JyfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sys:JyfJ4yL/tNCJPXUQrP0
TLSH
T16CC423AB60D5948ADE5587F81A88F000C7047EC6672F62F7EF82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e57a062f98ef021281cbd79afcbda8011a918aa8bee56cc719fb649bc23be21d
MD5 892f730fb43c9ecdc6d24aac46681f10
SHA1 d464e621ae1be673bc88f5d6abc0cb35d771e2ea
SHA512 043c8914da676bd4b6b7c8686d999341a71314c55baf120a03b295978d62bc8d4a6e9eac79c041f93b6b26cc251a75e365bee73f2b85fd6e64230881cde1a4a6
SSDEEP 12288:1VfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sys:1VfJ4yL/tNCJPXUQrP0
TLSH
T1F0C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF42B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 21e0db9590f734fc758b8a828680f10a08c49d679b5ec699f3404ed9d0dca61e
MD5 b2a54bb429d94ebd6229986bab85d4c7
SHA1 ccc5fbceacfc4d841616edb38646e0cf1d34cb09
SHA512 16a1f39e6ff18ea0cc1fb0e9eb01458e51dd2c3e6870ee07a57eb285b62571dacdcf71c8d86186019be0e87d4115f1236ae4b259f7c6d0758a59c92287796d56
SSDEEP 12288:zhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S9:zhfJ4yL/tNCJPXUQrP6
TLSH
T1DAC423AB60D5948ADE5587F81B48F000C7047EC6662F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 498135897a76b296d89f7b00cef53e61b59c41d2dd5549cc4a3e08b28064d434
MD5 506013b766efffd44586fddd9f12969a
SHA1 8e9d29f78d6fa073fab04e7248d2378b158bec2f
SHA512 72b5196ff1bebe48d0a6fade97f1b4c330bd632ac882b6577705d52e4196ebf0f59ba2bd5c0ef32e361b370434497ad77f82f044bb109e3d2adb860b8aecacba
SSDEEP 12288:riZwbDzzFEoS2cPvy5fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:WZM3zFVSO5fJ4yL/tNCJPXUQrPl
TLSH
T1670501A5B39018F8EC67827D89549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 528d4b0943f8f14000a869e0ef87127404f76d248eeade5e46ac88996c8b95c9
MD5 d1361f3ddedb1b1c85eee68137e175e5
SHA1 5f029b2acda61a3ccaabe6c7b14ac280a71c69eb
SHA512 991ca4932851402f63340cbb8121252294ab96e25cd2b92897d925f8ce3bb59e380c6fe224de285b7a688151fecc617f1112050d310a0bda0f3a8d6225c6beea
SSDEEP 12288:44fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:44fJ4yL/tNCJPXUQrPz
TLSH
T187C423AB60D5948ADE5587F81748E000C7047ECA772F62E7EE82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6a9491c801e0c0850cd7eb4e25c0cc53f1b4993742b2497b04d23bb4c38da625
MD5 143714a79690980595f043faaf7e990e
SHA1 d3b096796a59554c47d5fb9ac26fadd19851619e
SHA512 ded3d93b0c0571c19131ba9c1f95c81c05f6514d6a8d8e67cf563ad64adb7eda9aeded35af6122832fbb966b1d046239a0bf88152f5e4e2bb684291f9d6e2bf9
SSDEEP 12288:1sfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sg:1sfJ4yL/tNCJPXUQrPz
TLSH
T1CBC423AB60D5948ADE1587F81748F001C7087EC6672F62E7EF42B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 b86b1400d9b05f969223e645a8d88127df874a58906a98f8b7c5fd35ce252e8d
MD5 d3f7268c29d63ee799316949411299e7
SHA1 6e28fb98da953725b9bc26fdf8b28fc30e81b48f
SHA512 ebcc72371e5fef323a79b2539c5ddc8b089c35dadd4c1d4430f70c69d50b328206c91f04a877fe6c6674389fe2e6225f324f83bb377c92d820f5f53ddb7adc38
SSDEEP 12288:9yPz5L8NfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S4:0zyNfJ4yL/tNCJPXUQrPT
TLSH
T1EFF4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 ab44141215726ce3ddaed1dc74d2b12adedfa67c458e145c6d1d9cd20b00adb7
MD5 ab6bbe95716b8752fa423106c6f5655b
SHA1 d0443c7d806bd0fe588979fdb15d9878cbedcb63
SHA512 1691e08d28abb8080406ff802f5ed338eeaabbc3cf315514b84711a2746ac98550af57568745e0674efa35b0d826f46acbd88e70c1174228916b0b6948bc05fa
SSDEEP 12288:Y4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:Y4fJ4yL/tNCJPXUQrPj
TLSH
T165C423EB60D5948ADE5587F81748E000C7087ECA672F62E7EE82B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 80c716fee700c1be41eb6fbd7c869fb099f0ee68c0272b11d3ce9c52ee53b53d
MD5 ce11c571eda43cf66626ad010691ba59
SHA1 d0764325556f134af07f1f7b96df527c96ebf064
SHA512 cec5092a04b6aa3deac3b08fcbdf782c4d1f532d40b826d7938a041c97a6a0ac085279cb20740c20982cede75c2069a6768cbf433565aef1e0932e0ff7b17c33
SSDEEP 12288:+4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SI:+4fJ4yL/tNCJPXUQrPH
TLSH
T158C423EB60D5948ADE5587F81748E000C7087EC6672F62E7EE83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 81fa3405eb8408a3956c61194cf6a841eb48c631b0d4b3cf0c3e4f46624eb811
MD5 27caabac05dc94ab14731e19d122da41
SHA1 8077daf8462edd165cf3156a57787a957fba8883
SHA512 da768d48252d793de21451eec30e91e202db3f9496b51c614a26c0294808636dfcf5a7d11d1aae601fb8d1ed5feb00ad8060a833f0e42f148095ef5b031d71a6
SSDEEP 12288:PyPz5L8NfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Si:izyNfJ4yL/tNCJPXUQrPZ
TLSH
T123F4125732A130F9D53682788990A602F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 dda3807c8bd579d14267ffeb23a4b289a3da67f6d4a887aff98d476570370a72
MD5 c79b4972b33f63308e484aea8e264c23
SHA1 79825af050d2d2c024554bec9916d0ee876d7f76
SHA512 a4686c705bd1e170953871a8697faa0045de17d07efbf8c6f5effa28b4c5f5b0532546e26dc5ec929e1f4946ec06d703035a5502b8e136dee5c35e7d72741aa4
SSDEEP 12288:BCd91WYoaLHF3z0z04PDvhvfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTB:8T8aLl3z0zDvfJ4yL/tNCJPXUQrP1
TLSH
T1320501A9B39018F8EC67827EC9549502D3B27C9A0770C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 d5fd0ac0dfd5ec8d9a2aa2cb80423e8260267ca6a75ee9bbb25913315227087a
MD5 346fea52fe316a2ac6d5543a5189f1b7
SHA1 b62ac27e52181e3279aa6a5775293ad82cf91e61
SHA512 45d45e24711079af1fc6c84fa22eb73ad1800025fbe159c7db2721202db9e99ac93e909a23ecadcc3a3baf7d036576f7afd6e1089f2a29ecb75eb1d190cc0d40
SSDEEP 12288:Ai4e7+RdTfgwCHKy7GLbbdIvOfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGM:A3rd9CHKy7GZLfJ4yL/tNCJPXUQrPD
TLSH
T15025CF91F3E410E8F0B7CA798D659501DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f33d226fcb7ff8cd6730e3ac3ab4bb85f99520536a85f0faf8e6abdfaa64804e
MD5 0ac4e6dd8cf5a739b6f25460aa218998
SHA1 55f16b3cbff667c1d1ed05707cbec64e59593d07
SHA512 d053bfeed3c0fda3458eb17238f7375be4760780eaeb635efc64f83de835bf3f802444d57cd92362ad7ac99ead1fa3770e52cff6560be8b915026a3de3859449
SSDEEP 12288:offJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SV:offJ4yL/tNCJPXUQrPu
TLSH
T1B4C423AB60D5948ADE1587F81A48F001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 084782c0c43d017385a8f1b93edd40675896724882f64f379428957339caebd2
MD5 6e824ee06f91a5c8a1615d67b70f773e
SHA1 3e0a3729ce481873b29b6f035ae496bc76f76f45
SHA512 7732ca6f8b7bb9bc8edaba660e6e40dc859e8c7d6615c7feefba49f764985a87d57b4dc0762b9a37df607bfed1d49cb50d572d92e7ca229098af380471feb22a
SSDEEP 12288:2tfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SR:2tfJ4yL/tNCJPXUQrP+
TLSH
T1F1C423EB60D1949ADE5587F81688E000C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 9475da034ce61c0d497e7893c09747027f5536b90aeec7f11cb0a9483b606012
MD5 30899f0c23ea950499713ab8ed97142e
SHA1 f8130abdf733f6ae9d118bd794e04b06358d9f72
SHA512 2445661e6a49e94199a88ff059b6fc66326be2d64f30c0cd5e6ebeb7438d82edfd8cb08c3440304a40c2f9cc27d2343031b78c37e87501e8f6ac34511d3b1daa
SSDEEP 24576:H2wvrk9RX6wkyAI8fJ4yL/tNCJPXUQrPLaaKngL2jdshRTdG1YxITqvfPkbIcbjK:9MnYI8fJ4klKXnTaarSj8RoTCCW
TLSH
T1CB85012AEBC844E5E177923C9DB7860AF6B178591B32C2CF029653AD0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a2c69f87f3cf0b1324e5b26f9d3c19081bd39edb2121294a83724a58f5207ffa
MD5 110a4a470dc6cfb788fb42de2408880b
SHA1 7e5399aae016aa449256e1389ee1bfb525dd4a58
SHA512 59273930b5bc7b32213b93a93bd14732e5c20a22a2bc84182c7f8f0f1adda3e14722ac13b3302ea3f4d462f2b82d0a23abaa9e59b24bb5c166766fb30d2fa56e
SSDEEP 49152:dYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zfJ4klKXnF:MySzPLfJ4k
TLSH
T124066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 edd4bbf43855e234937800a12c9c3dc8f8b2e1f30e11dd7f7b6f9bb0f036263d
MD5 da56f62fe40b61df763e0ca9416cbe11
SHA1 b6f5109d60a307c0ba680473070f0be3f578e6c8
SHA512 c5af4db9c62d9f1634a19564311e13e1de94c695740c68b9e7e582f9d8828eb0b51535afd74fe406356e19b680479f38ad652dcc07a9a565e478f1973bc985db
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYJfJ4yL/tNCJPXUQrPs:R47JUQjqirIhCnDHUPfF/DfJ4klKXnU
TLSH
T11565AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 bcd43c4f69ddc98c33741eb504ee3c63c4ac4e7ae28262bbf58f473637a99f34
MD5 9defa275b9540168a6ba911e528f42b4
SHA1 51294383c320247e55e5e489cf35293d90215051
SHA512 e39cc86451d87348daf42732e31a2d1bfb1814ec895d0ff75f993f8033769a9f68d63fbf6e70c7ae85f874b13000a232b6120b1b6b443d45115b6fbc6efc0fd7
SSDEEP 12288:cpsfofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:9ofJ4yL/tNCJPXUQrPG
TLSH
T1E4E4015AD29841D8C46E92B8C7449201F3237CA593E2D3CB97C0F87E2FBA6945DE9743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c20dd5beed75291d96466ddc54210fd455a29233a3144d848e5619fda61aa48d
MD5 77400f63e755be03c4388fff62b58c94
SHA1 a724c47d6f01c1558cb73e601623aea8207dabb3
SHA512 04849bfb67ce2b989cf691a4ba53a17ff43bd959fe07a62175f8da81286bf140061aab60c170bb414458450f2bcaec93dacd31345ed6af1ddaf8133b7d06cd3c
SSDEEP 12288:jPCH5tU3f9MCvDFVGLvXjwrgDrcPWHyyVOW9x9V:j2rUPeCrcvXegncP6yy0WT9
TLSH
T1CD3507007666DB4FC6A940321E73D2CCAB707D41EE44AB0773C9873F9576658BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 321KB
SHA256 8cf92e77ead2ac544b80620a336b83abe6e19a010f76715f651c304158a4b2ad
MD5 6c5e97b4b0a1e898d0307ba06891d392
SHA1 59c8df3f0476b0ec2b4c591703785de7ad801a20
SHA512 36db339cf681e10ac1972e2183ff74265977036c1cc4ca85f1445416d80f68e1d3af35f378f84844476845f0ced4a239c5397d509fb60a774d1701496e62a731
SSDEEP 768:dRR/TkjlToOlTPBlTz2+EQM4RW4d/Tf72jlToOlTPBlTz2+EQM9qUeCjlToOlTP3:dRD4E4d7L9qUg0qQpHv+ANh2nfk
TLSH
T193646111B750F329C4B680764861D6AB9B3DF122CF2247033FC91A99DCF224B667AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1987a60f-b44d-405b-af0a-b575fe6a6681.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1987a60f-b44d-405b-af0a-b575fe6a6681.tmp
Size 37KB
SHA256 4d5cbd24fbf689c7ee138f80b2d52739d3430e74beb943b6b70fd01b8d924a3a
MD5 a743811e7e3b91c09675b07289f0e33c
SHA1 8c1982b2f8fde61cfbff3d891800367a9e67f7ef
SHA512 4c83827388cf51f47a3b6c1e408b578d78b96dd2a8c5d42feaa33e7f369cf999a560442e079435310824c9bd0a2a71023150f320017a5a3615dea850952f74ce
SSDEEP 768:zdPiFHy3Owg8qw2BRJU2uOs241TknUPO4Qp7cPAiSm2eo4w4cciGrTFlv4YGHKZ:z5+y3EJ36TkwQpYoimeoR4ccFFl4YUKZ
TLSH
T149039D72D8A4EE77ACF797C5BA097A82EFF0419389C95DC4DAC95E4D008329E070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6d9fe33745433648404cbca627665251d2d74c4438394be94b9a354b3ba41c95
MD5 2584d03ca75f540cfcf496ff85e62863
SHA1 83020f854f45dd35efa5efc1777f212ee0d7ea25
SHA512 06ec5194cd4c41c1b9618148858c11df094f3e833fcf813c783318369c05ad86954162dc2653bd4df93c9bfd9fb03cb5fa267ecba46cae903ac1c8ed78887b29
TLSH
T15F61AC4A97A8A242C75CC13DC7C8C1CF3F3AD4BC9A837EC1B195E1792963BB8900420E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5889261a328fbefa9eba32436ba5a27845f5cf53131372bfff436e78264d9a66
MD5 630687d6c17b066d6dca6ab1a81582c8
SHA1 f305904b51bd2c7041038cb1b9dbffd07ca725ef
SHA512 5e8debc331838cd6e26d76ba10a0a8f5c2513a254361a2d71f63a06463a07258393e3356ec7b2abaaf6f4010bcac0f04710b9badc061db97b76f2f1930a64b4d
TLSH
T1D7518DF3C3F9867D8A1295F4EA142E1BCE1D0911436C7D9A85E49E1B93F2871E18099F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2917fd5c03faa2a73386334a0d91bf6578b3aca4779e3582667b60e9bc3fb19a
MD5 ceabec58577a7c19823e77a2749c6447
SHA1 cb37a669633adcb37a907d97abf1d7ccf14ac671
SHA512 f1452ca1ef9a1446e9196c2934d776094318b46048d26e7832d47bbd196399712684e96ac30ceaad666ae7af90f0ac12f26e928cfcb609eb84f28b869d03336b
SSDEEP 192:sxRLrCn/fe6sD5aZi0BzoA8pK4/g6+WNpAm/YcU+6X5iToG/IgD0kJ:sxRLen/fe6s9MaX/53/IpiTrJ
TLSH
T11C42C655AD28F97B8CCBD21DBB55BF53D2F95032A0901E48A6FC8A1C15E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f113625ddb807c8bb6ace705ca19bfdb04c0abbc44aeac832f8713df5f3a529d
MD5 204600afa60136d735859d870232dbfc
SHA1 d609e709b63b5050376c6c1846363d74803fef25
SHA512 4f7ce546166e70cf6dd7f9d6e63656bad2becf00ed5446522e5282e8459a952ab49e7b1616651fc0ed9c26fddc01c68ab6a4f834b77221abdfafa6458e56b2c3
SSDEEP 192:sxRLrCn/fe6sDwaZi0BzoA8pK4/g6+WNpAm/YcqIX5iToG/IgDOkJ:sxRLen/fe6sEMaX/53/TpiTrP
TLSH
T1E342C615AD28F97B8CDBD21DBB65BF53D2F95032A0901E48A6FC8A1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 94185f8fc6ba2d365c10d4f51cf049e586e822d7f22a56c760fa536cf6da6e12
MD5 854600afa84a92432de701ea0306c210
SHA1 b77b3c33aaac9f77212e7f4437aa74b2bede2148
SHA512 82fc2c4335b3cd69901144cdcd5821f713b9d6deb50f87341e7092329a4241d9ccfd602f8398b641c2f029839d027c49eb82122006097aafaafe6de4b5d652e1
SSDEEP 192:sxRTrCn/fe6sawaVAzoA8pK4/g6+WNpAm/YcqIXtiToG/IgVkJ:sxRTen/fe6s7iX/53/T9iTra
TLSH
T13332B815AD28B97B8CCBD21DBB657F53D2F95032A0951E48E6FC8A1C05EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 59a30151301371637ae7bf1fa7221da13cd8a4bd0d27c9abbbd4ec3ea3c4afbe
MD5 e36674ac162ce19748b67ebb78dc3b29
SHA1 ad24460481255ea25d6eed181135a7dde232aaf6
SHA512 54ee57cad1ca659a26b70d776b33c73b211ac6b073780cbe68e527688d20d031c4443be498e608c2bec5bb49befdce68b2f1b534db309dd20f01a585fcbdb334
SSDEEP 768:DFak24yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO97gFroMNz:DFak24ymEbs5Wg1Bf9tu1ja9xg+MNz
TLSH
T161C2DA7B744CCB7E4F804A9D9C197E9B6DA802CB9698CD8047FE941C03C67EA52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e11beb32101c4e4a701a6211779704cc9150ee74916e2d0336639c22c043485
MD5 ce2842a8cba6319b4811e80dfd73216a
SHA1 7dcbb2a1f0c2bdc31b2d67880ee622b35ada6c87
SHA512 ddb7ac1535a62c0599080afa8145723cbcb668dcbf475995e00749d5e8b6e44aec2d3877b33d477c22c856a4f4009758bbc507468ea3c565c6675ff491241d82
SSDEEP 48:KwZIFKCIAXyZuI/KjSE4FuF3FyFOFAFoFoF+OFYFZFlI7FuF+KIFLQFEF+8FWFu9:KwZCKCIaKugKjS0/OKogut
TLSH
T1E6914510313A028138BD34588194DA1F5A8132AB3139EA3B3BBD55965F77E48BEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6c7e156-8bcb-4fe9-b669-b13c171b0815.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d6c7e156-8bcb-4fe9-b669-b13c171b0815.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 011a13c3edde8f5d8999ec88528c154e1eabd9b55f9445dfb99e38043519fbae
MD5 5aa195eaf6ea0cc463905f45b1c8a54e
SHA1 3e4ed7e791cdc00fa3ef673d90bb9e8050d22a1f
SHA512 8f3bd927281aa63727610913ca307345259dd1d4a1d826ff45e86115023786fb809758e9f1e1291069547ddbffb954ce4465cb7a81559bc05d386ceea64dd382
SSDEEP 768:rdMg3bqw2BLJUIieOs24ojZnUPO4Qp7cPAiSm2eo4w4cciGrTFlv4YGHKZ:ryg3EJbgbjZwQpYoimeoR4ccFFl4YUKZ
TLSH
T140F2CFB1E8E8EE735CF69285B9196B82BFF04163A8C50E88C5D96F0E414379E1717C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 a87102886795639af07db1fab8c7d79bcda73847a65bee4029aadb00f4aaff23
MD5 363425265e8f2116eb0dbf7b955c2436
SHA1 45a49a290bf356b47ae5694bc59b359ecc5e51ea
SHA512 28758ff8bb04caaf98607609dda0491090ddd82b21816587df8fa7c92472635b9fd8c2763bf70f6aeece0f2d9adba3b7774c1ba7b23a0870149d0c7f94ffb425
SSDEEP 768:3PMg3gqw2BLJUIieOs24ojZnUPO4Qp7cPAiSm2eo4w4cciGrTFlv4YGHKZ:3kg3lJbgbjZwQpYoimeoR4ccFFl4YUKZ
TLSH
T1C7F2CFB1E8E8EE735CF69285B9196B82BFF04163A8C50E88C5D96F0E414379A1717C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ac5ee826694a231b89ccf602e24c77e5c57a4719d1ddf2f2ae806770c460f6ea
MD5 c0496eede207cc4b73144cb1726db513
SHA1 8cabd5771a7d0a10b2725e66a9e9f76b5f8f9238
SHA512 4cb8d2fdddc35044a5334ae6a6262362986287f01c38615110c424f6cd6c759e85b153974537df3acadb6447834ee9dd0cc5935cef39729d313b913c11468576
SSDEEP 768:3Pf/UxvxjgC+F3liqw2BLBUIieOs24ojZnUPO4Qp7cPAiSm2eo4w4cciGrTFlvaZ:36Zj3+F3lzBbgbjZwQpYoimeoR4ccFFi
TLSH
T1D303BE71A8A8AE239CF7A245764967D3FFF0156398C11E98CAD96F0D428739E170BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 af3206abd9a6826b77e8a187b19b0e244188c924710702430bb7b05061cd595c
MD5 c9cb7ed6a8bd49393993bf890ce8cc0b
SHA1 dab49e831e44a6cb15d6a3654ee564dcd3f4ecde
SHA512 4d21408723772a31a2770ee7e1870ab5f0041f860163cd8c29f83310f28d27673dec3def440bb2ad41bd2f2667a5c70d758a3bd5d2247fd221b2154a883dc805
SSDEEP 768:vw/UxvxjgC+5j3sVxn83ieOs2ojFnUPO4Qp7cPAiSm2eo4w4cciGrTF5BAgZbCMc:vdZj3+5j3sbnEgojFwQpYoimeoR4ccFw
TLSH
T13A03BF75A8A8BE73DCF396843A5D6386EFF0416395C12AA4CAED1E0D42873AD5307C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

9615e51f-6895-4035-af6e-64e4877050dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9615e51f-6895-4035-af6e-64e4877050dd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6124_1419826386\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 51d95a69ee54827500462f8993189e8133bc4593483ba033a8fb01f2d7437814
MD5 7d288fc3345cd8ecf85e53bf0adb8e8a
SHA1 49cd556348ed0a70973d365b62a00b8568f3f715
SHA512 bcf138e22ecd0a8b9154bfec90f94f3dd330e46826fe14db54c269f029e858dab82f4e4a4ce9b5f4d6de6b3a2c61fce831385fc602575c64337969f8728cc70b
SSDEEP 12288:BM7wfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sh:awfJ4yL/tNCJPXUQrPK
TLSH
T1C7D423A761D49446ED7987F8164CE000D309BED51B2BA2E7EE02B4857FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 42ebe565257fd9bbc24bfb7a79a08b1c9866d560fa0cae3bb3aa7f96d6ecf1ba
MD5 19faa73a5654ade085bfb4bddc89bd3d
SHA1 a3f8a65a3662612bd40236246818390ca5e10b1a
SHA512 38ab91d5574c8749d6408dd368dceb2110ce496b221ae41a3d15bebda75a0c36359609be56e098c780cea382f12a87416c9788ec40e09623ac2f83e2bc556146
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYmfJ4yL/tNCJPXUQrPE:Ggb4mBIBhGFJfJ4klKXn8
TLSH
T1C165AF1E22EC02F5E0F9D2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 86453877620658a5cd4fd7b7c3ea362ba9d6d40fe3832f8e80f37ffb0e9b93b1
MD5 cd3f73fcaee9bbe2779df484727e7c2b
SHA1 5e562fec68583e1ebcde234b160d670ab28278fe
SHA512 05bb2cb9bbc7663b8566090fc2f4e9400329a015fb338589e18ec52c32c76e748b7d07b28fc42b2ea1e1a04a91dae7b4e0e63679c0d6f30ad40698bbc9a5ad2e
SSDEEP 24576:TGoaKngL2jdshRTdG1YxITqvfPkbIcbjLm:TGoarSj8RoTCCW
TLSH
T16805237EA7C56694C43BA77829B6984A3CF33758570A46DF88E0957C4F6A7E0363CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 c1993bf7552d6e0102ddd8eebfcf0f84843d55fd5f8a54178ed6471e8861864d
MD5 9adf8f18e2005feb198dde2f5758565a
SHA1 364730cdfbe54296a244c2a2369fea1b96b5bee0
SHA512 1154fcb106da2250b03f2e44e6ba3b96ee2d640e21edf035a2ba4ec800fbc16bf7cff1b5144f57e858e9e4965e17f7ed17a274e88a08a9bfe1fdf78b404921ea
SSDEEP 24576:bG88u8FpJqH1vzria7/m5fJ4yL/tNCJPXUQrPe:67ZFPqVya7/ufJ4klKXnG
TLSH
T14135026676E101F1D47BD1388A858663F771B8150335FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6d5b3b6fe1e374ae4089acb768258ccca24b6078375b80c203a78ea7827cbf53
MD5 d499cdadc52e87a4856c440c53970d3e
SHA1 eb1701416d7132ee311bd8f1e26c87f156cbed38
SHA512 9ec9bce14e7186e4fcf724c88ddee14e2bd6fdd06c7b8de58e3ca9757ef36ca3ac74cdd20486bde47ca551b5688e20ce2e89c5443cafebe443b956575b08ef4a
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVfJ4klKXnR:5G05lO43bEfJ4k
TLSH
T1FDD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dee7891bf76d1799972a7a316c8e7530f483718097bb186c5ccdd58845dd642f
MD5 759751563b0ff417419e41cb70588ab9
SHA1 4a7ab42099709ef170207879222a855293585cca
SHA512 85d07d4c4d649e2ee0da50dfb224a1413c978b8d113abf262ad0a676eaae83fa7583af5699dd60a3a7e44e691658ade04518f7a31332a337b02d172be5ca7997
SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnzfJ4yL/tNCJPXUQrPU:va5POZ3lJt2pasx2+mtfJ4klKXn8
TLSH
T13C65BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 77103edc4f8a3cb74d88d471fa3e9fe581da6218386b9dd3929755fc3c6e14f0
MD5 78c815240b26bdc9424ef9dbb48d290f
SHA1 e9532fb48f2adba7fc74650b6f1868c16f54a265
SHA512 bc666facf4f4526136c1a0e2532ade7e0993b83b41fdef9bbdd7bfbd18cbd320b4999e5858559f1a6a9e49c8bc1c705b36d2f0a2d98006cda04de7f9a42f678b
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkRfJ4yL/tNCJPXUQrPK:zNc/zEOVHFOfJ4klKXni
TLSH
T19C858B2623E901E4F5BBE1BE896B9546FA717865133086CF0291851B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 73789188aee0eb8c75fc477bd62a41d304b63dd7597676b70908c64eecedbde4
MD5 e70d0bba3b3a6d1330ff7b6b289390c6
SHA1 180e911a0db9a4696d921711a16c18e4e765aa82
SHA512 4f9080fd678210ad4d89600b6cfccc0f65cfa39c59f54785dbfbb70b7207f3344bf45b6959d972579a698e3ae15871ec4c7d46af1029a322b9c05afdff97fe2a
SSDEEP 24576:t6DIzaKngL2jdshRTdG1YxITqvfPkbIcbjLm:t6DIzarSj8RoTCCW
TLSH
T15B25126D63AA01F4D06BE13D96934506E5B2B5B483074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 57d317e41f3e7c514294a53d63384f423d9ca722e9c02eb1407d53144abbcd5a
MD5 a2ddd7b0d43c7e775c1302bcc8b2f075
SHA1 8144fbe18f16e61f8d9abed87d6682c26031bc87
SHA512 4852cd87f404f3e9f5c2dfda74485bb7f2ee48b2bec1b63b79ecb40ef79b241d43409b90e2f50e8a6bc68905556e7cf642fd3ed46d3aad2f0fcb48b13202b037
SSDEEP 24576:NtyxaKngL2jdshRTdG1YxITqvfPkbIcbjLm:Nt+arSj8RoTCCW
TLSH
T1DC152319D7C456D4E57A27786EB385882D727E289B0783CF89E0E63D2F767D06934B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 a392ba61f155691b5804be52746462bbf665248f110139ecce314e00d4571e07
MD5 b34b3ddcfd8c102a4eb93b34c62c99d3
SHA1 b555f7b51eeec89ccc94f0497d86cd2e9ac8de7b
SHA512 f9a56e119b23028a29706f09e4d30baadd08fdbed52436ef50d19738b2cdf9c94e1f6a463b9b81a970f4e471dfd7246dd5636ecf0d904ce3ecfffa7b68cb19d4
SSDEEP 24576:iIaKngL2jdshRTdG1YxITqvfPkbIcbjLm:iIarSj8RoTCCW
TLSH
T13005237EDBC45BA4D41A7B743AA6A94D38B33B6C570B46CF8CE0597C4E7A7D02638900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 8c01169064e7056023006422e23ec0f2978be2b43c6c80739ef4f64b6ffc5806
MD5 1ff27e42b3c3f74229773306036b2943
SHA1 c182e089ed4286819e063e351ddd34c437488fe4
SHA512 db84c14523c074d5d8cbfffdc5ff0bc7b06a36031f64088ace62fe573eff1bc5b274cad687f6c09facacc08ef43320d4556c7e8d1e1078e422932354c1995ede
SSDEEP 49152:Wgb4mBIBhGFJfJ4klKXn8yarSj8RoTCCW:Wt+fJ4kiJTy
TLSH
T10EA5D01E22E802F5E0FAD3B89DAA4407D6B278160736D2DF1151426D2F3BEE89D3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 22f6cba0ee5ade3c2922837e04a92aeb881b27a7e5e8fb7900d64636a5dcd49d
MD5 db36a9709633e8d4778ba4ea3d837a44
SHA1 24e7e3a6ad6abbaebd071c06bdada07d4eeff200
SHA512 878b42ca7b3652c31cc0244e4f6d12e59159f69f9a43b17bc332de93d15d87b785ef7cf634782ac4f510574a1d41a4e2de9c176dda6c73385e04210c02f1d8e1
SSDEEP 24576:AgkNvNnaFeYhJNtmZBm3fJ4yL/tNCJPXUQrPO+aKngL2jdshRTdG1YxITqvfPkbk:AgMwBtOm3fJ4klKXnm+arSj8RoTCCW
TLSH
T158A5E16EB6E846E4D1FEC6B49E238512FA727851073293CF8290C13E1E679D85D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 d0827fa8e2f325ef45993eec81f4f53b949e9086cb8b639cac89ae7885c355dd
MD5 c4342617efdb69fb059d1662b33369b3
SHA1 c56260a5cb2c74886e7058510f70fc27dcb087d2
SHA512 9c2e00399c9f9a1ac17ca6da390bc82faa95b581494d14755649392a999e7ee13cda831214040ac6c706e597b40067678c23f51ddb90413f2b0d4be541bc1711
SSDEEP 12288:PHvUrBFrEjwaQlfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7ST:PPUr+NQlfJ4yL/tNCJPXUQrPg
TLSH
T1AB05F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 6d995af566300de7e9fee0d6ce26a57727e0ce4dfe657ac3ca5a1b5490eb4706
MD5 db94a72515cc46442e613c873e112b40
SHA1 cc8294675518729f42773813b053338975785f57
SHA512 0d7c589bc62e4cb5297f211f9ce8afdf293688e275229266fef14c28b63e3b138d194c1e5824979c15815508d8f597908cdc9c0be7e88afaab24fd1c10820cf0
SSDEEP 24576:1D3FHshBIYQgAUfJ4yL/tNCJPXUQrPhBaKngL2jdshRTdG1YxITqvfPkbIcbjLm:1DVHeBIAAUfJ4klKXnZBarSj8RoTCCW
TLSH
T1B985027EE69C04E4D57BD2BC9A939506E77138ED032656CB06D081B92F6BEE42D3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 7f5c79f4ea6a25afaf9e0de6da9a28cef0af08dadfde2d0a467be0d68d2c3665
MD5 7adbb03fdb6ee603f8e5e9619452bf4a
SHA1 069d41b40a825e8d1201f5a816c0db4431aaeefd
SHA512 5eb316ecd8d10a3a945947fe66be7919d514be0da8d859a830d951e3a29c97674fd4caff53415d7af12e68e6b79d0925db2fc0304536eeb8af299455c9ef0587
SSDEEP 24576:wJnJPbzB4SLaKngL2jdshRTdG1YxITqvfPkbIcbjLm:wJnJv6SLarSj8RoTCCW
TLSH
T18D35F13DD29810E8E4B7C2B4815A1B5ABE71387D2F1669CB59B4D4343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 bbb8e1e3512ce6489198d9fcbf7257f12478e1e4b68ac038c6c6ed1206be0d42
MD5 ecc0a04ea89a73dac38dc901d24ff275
SHA1 1de5cc8090a4378b389f352d361f88b461072565
SHA512 0dc2b12f9f78890c8c1a74eb332339705fbde8b3c19579c42acbdd33d65525f2289df75d7be8d0624bedd3ca0cdbb24653fab9bf24df0f6cd39f4f3826974562
SSDEEP 24576:SKaKngL2jdshRTdG1YxITqvfPkbIcbjLm:SKarSj8RoTCCW
TLSH
T14B0523AFDBC48B94D55B3B743AA6A84D3CA33B5D974B47CFC8E0259C19AA7D0263C440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 35ab33e0ca6637bf3163a0ed61fd05316d576c47890e95fdebb25314463b11f5
MD5 b8335d2bbafd75968df37e173c03d625
SHA1 fbe647dd21239ee1e1846345c013e0bb97d1b705
SHA512 7f1f9c2c36e10807ba56c927179f431dcd0887f042f4ed901d0c27ee9d841155f38d600d9a230a822ccf66b9208d9c28a828bb2d6f695023c0cd4a5b3623ac2d
SSDEEP 24576:k6UqjpiaKngL2jdshRTdG1YxITqvfPkbIcbjLm:k6ULarSj8RoTCCW
TLSH
T15215236E97C459F4E03A1330AAB6C10908B27E7A035B86DF65E4967E4F36BC0953EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-169-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-433-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/236-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/236-435-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/916-168-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/916-91-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/916-688-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/916-686-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/916-97-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1252-126-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1252-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1252-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1252-132-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1632-421-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1632-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1632-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1632-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1632-415-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1632-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1632-423-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2540-78-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2540-166-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2540-72-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2808-467-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2808-172-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2808-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2808-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2876-1-0x0000000002C10000-0x0000000002DC0000-memory.dmp

Download

memory/2876-10-0x00000000032E0000-0x0000000003347000-memory.dmp

Download

memory/2876-50-0x0000000000400000-0x0000000000C63000-memory.dmp

Download

memory/2876-15-0x00000000032E0000-0x0000000003347000-memory.dmp

Download

memory/2876-8-0x00000000012D0000-0x0000000001355000-memory.dmp

Download

memory/2876-7-0x00000000012D0000-0x0000000001355000-memory.dmp

Download

memory/2876-2-0x00000000012D0000-0x0000000001355000-memory.dmp

Download

memory/2876-0-0x0000000000400000-0x0000000000C63000-memory.dmp

Download

memory/2876-357-0x0000000000400000-0x0000000000C63000-memory.dmp

Download

memory/4172-29-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4172-336-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-21-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4172-27-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4172-28-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4176-167-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4176-82-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4176-87-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4744-59-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4744-46-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/4744-56-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/4744-53-0x0000000001720000-0x0000000001780000-memory.dmp

Download

memory/5320-122-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5320-116-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/5320-170-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5932-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5932-67-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5932-173-0x0000000140000000-0x00000001400CF000-memory.dmp

Download