d11495876096be8cd02e63927fb8e5b2827a2d468dbaa7ed6a3010b9ba577a4f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 1.6MB
Sample261102-s4mftabs21
SHA256 d11495876096be8cd02e63927fb8e5b2827a2d468dbaa7ed6a3010b9ba577a4f
MD5 890864f91f9329a5cea9657d79974a76
SHA1 c464462f5f04759c605a2d2381f25ad482b1dcf3
SHA512 8544d9deb437bae6c784bce0b285f7c946997ad117c1ea7a0128a47323306ea93d609c7467daab6840195bfe1a129af740056a72fbe6a600fac50527a62e37b4
SSDEEP 24576:Nyy2sp+WTBmvUmwZ8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz/:Nyy27WTqUFZ8LNiXicJFFRGNzj3
TLSH
T1ED7502117685A432C1B305324B6DD22529BCBC315D214BAFA3D87F2DEE756C2AB24B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
556	alg.exe
980	DiagnosticsHub.StandardCollector.Service.exe
3212	fxssvc.exe
4372	elevation_service.exe
948	elevation_service.exe
2936	maintenanceservice.exe
2692	msdtc.exe
3256	OSE.EXE
2608	PerceptionSimulationService.exe
3820	perfhost.exe
4568	locator.exe
3508	SensorDataService.exe
3972	snmptrap.exe
2828	spectrum.exe
3068	ssh-agent.exe
5072	TieringEngineService.exe
3304	AgentService.exe
3824	vds.exe
3720	vssvc.exe
4392	wbengine.exe
1168	WmiApSrv.exe
1216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de0990b2288da564.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4624_492027056\smart_switch_list.json	msedge.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\java.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_157859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4888	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000267e23a3e06add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000742b91a3e06add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000413bcca2e06add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009cd3b0a2e06add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c12d34a3e06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080a70ba3e06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa3ca4a3e06add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d9fbd8a3e06add01	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{F08E000D-CE0D-4876-B3EA-47EF76749FFD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
980	DiagnosticsHub.StandardCollector.Service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4372	elevation_service.exe
4256	msedge.exe
4256	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2800	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeAuditPrivilege	3212	fxssvc.exe
Token: SeRestorePrivilege	5072	TieringEngineService.exe
Token: SeManageVolumePrivilege	5072	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3304	AgentService.exe
Token: SeBackupPrivilege	3720	vssvc.exe
Token: SeRestorePrivilege	3720	vssvc.exe
Token: SeAuditPrivilege	3720	vssvc.exe
Token: SeBackupPrivilege	4392	wbengine.exe
Token: SeRestorePrivilege	4392	wbengine.exe
Token: SeSecurityPrivilege	4392	wbengine.exe
Token: 33	1216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeDebugPrivilege	980	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	4372	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4624	2800	2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe	116
PID 4624 wrote to memory of 5096	4624	msedge.exe	117
PID 4624 wrote to memory of 4888	4624	msedge.exe	118
PID 4624 wrote to memory of 5008	4624	msedge.exe	119
PID 4624 wrote to memory of 5008	4624	msedge.exe	119
PID 4624 wrote to memory of 5008	4624	msedge.exe	119
PID 4624 wrote to memory of 3148	4624	msedge.exe	120
PID 4624 wrote to memory of 3148	4624	msedge.exe	120
PID 4624 wrote to memory of 3556	4624	msedge.exe	121
PID 4624 wrote to memory of 3080	4624	msedge.exe	122
PID 4624 wrote to memory of 3556	4624	msedge.exe	121
PID 4624 wrote to memory of 3556	4624	msedge.exe	121
PID 4624 wrote to memory of 3080	4624	msedge.exe	122
PID 4624 wrote to memory of 3080	4624	msedge.exe	122
PID 4624 wrote to memory of 3380	4624	msedge.exe	124
PID 4624 wrote to memory of 3380	4624	msedge.exe	124
PID 4624 wrote to memory of 3380	4624	msedge.exe	124
PID 4624 wrote to memory of 4444	4624	msedge.exe	125
PID 4624 wrote to memory of 4444	4624	msedge.exe	125
PID 4624 wrote to memory of 4444	4624	msedge.exe	125
PID 4624 wrote to memory of 5420	4624	msedge.exe	126
PID 4624 wrote to memory of 5420	4624	msedge.exe	126
PID 4624 wrote to memory of 5428	4624	msedge.exe	127
PID 4624 wrote to memory of 5428	4624	msedge.exe	127
PID 4624 wrote to memory of 5544	4624	msedge.exe	129
PID 4624 wrote to memory of 5544	4624	msedge.exe	129
PID 4624 wrote to memory of 5692	4624	msedge.exe	131
PID 4624 wrote to memory of 5692	4624	msedge.exe	131
PID 1216 wrote to memory of 1664	1216	SearchIndexer.exe	135
PID 4624 wrote to memory of 5396	4624	msedge.exe	137
PID 1216 wrote to memory of 4208	1216	SearchIndexer.exe	138
PID 4624 wrote to memory of 5716	4624	msedge.exe	139
PID 4624 wrote to memory of 5716	4624	msedge.exe	139
PID 4624 wrote to memory of 5132	4624	msedge.exe	140
PID 4624 wrote to memory of 5132	4624	msedge.exe	140
PID 4624 wrote to memory of 6088	4624	msedge.exe	141
PID 4624 wrote to memory of 4236	4624	msedge.exe	142
PID 4624 wrote to memory of 6088	4624	msedge.exe	141
PID 4624 wrote to memory of 4236	4624	msedge.exe	142
PID 4624 wrote to memory of 628	4624	msedge.exe	143
PID 4624 wrote to memory of 628	4624	msedge.exe	143
PID 4624 wrote to memory of 4328	4624	msedge.exe	146
PID 4624 wrote to memory of 2716	4624	msedge.exe	147
PID 4624 wrote to memory of 5284	4624	msedge.exe	148
PID 4624 wrote to memory of 5412	4624	msedge.exe	149
PID 4624 wrote to memory of 5412	4624	msedge.exe	149
PID 1216 wrote to memory of 5584	1216	SearchIndexer.exe	150
PID 4624 wrote to memory of 5824	4624	msedge.exe	152
PID 4624 wrote to memory of 5824	4624	msedge.exe	152
PID 4624 wrote to memory of 4328	4624	msedge.exe	153
PID 4624 wrote to memory of 4328	4624	msedge.exe	153
PID 4624 wrote to memory of 4016	4624	msedge.exe	154
PID 4624 wrote to memory of 4016	4624	msedge.exe	154
PID 4624 wrote to memory of 3348	4624	msedge.exe	155
PID 4624 wrote to memory of 3348	4624	msedge.exe	155
PID 4624 wrote to memory of 5508	4624	msedge.exe	156
PID 4624 wrote to memory of 5508	4624	msedge.exe	156
PID 4624 wrote to memory of 4256	4624	msedge.exe	157

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_890864f91f9329a5cea9657d79974a76_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ninite.com/error/?source=fetchapps&code=1483&message=&error=0x80004005&version=0%2C1%2C1%2C1183&os=10%2E0%2ESP0&key=&date=2026%2D11%2D02
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7fff2523c188,0x7fff2523c194,0x7fff2523c1a0
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,15532397278348945734,17023716090989580949,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,15521964917870947030,2651491685931838332,262144 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,14037409958624166448,15457126550245069189,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9380396448839155431,5646189819812308674,2097152 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
    3⤵
    PID:3556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,215260223799852282,12642976589794376591,2097152 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:3080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,2203734239283198256,5320811571374941504,2097152 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,17457100865221239206,6085266655124273258,2097152 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
    3⤵
    PID:4444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16297036283016446551,7817473925977055879,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
    3⤵
    PID:5420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,16764717365048984521,5528525471749014585,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:5428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,8150037256096011894,2045829047304122144,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,10915798012348348037,7001673431333148745,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8574962654714437523,5269363267863308107,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8574962654714437523,5269363267863308107,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2849835944004677696,17822940866643945918,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:5716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,12929986470873058825,10648995718507179175,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2820825341580272003,4319157728517782050,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,17273323546572570858,16076190349583393682,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
    3⤵
    PID:4236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,16449810045783595016,225004948824449543,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,14544453386752047237,1762059104788048287,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,17728111890213676045,9035859958276351449,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,2701647749116837866,17570809038972157377,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,10578874384264631926,15541129998868451436,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
    3⤵
    PID:5412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,16907813025880541101,7578683452920821434,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,7281094077151261116,14826135522495756024,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,17831131933818694416,2907533650898069396,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,15709257786405436015,57258178856300702,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,8889126693107231915,2447262664893686799,524288 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
    3⤵
    PID:5508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5384,i,5683862212403892319,7607763756290214622,262144 --field-trial-handle=2348,i,3042238225905722392,2171075599567118195,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4256

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:556

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1240

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2936

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2692

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3820

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3508

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3972

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3068

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2504

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3720

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1168

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1664
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4208
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-895009113-1202185046-1686627690-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-895009113-1202185046-1686627690-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9cab991941419abe0298b5b35c286f2ffde2988c3ff803a68d41de8e5bafe7f6
MD5 6ff5d0c3c4bc8f50723419023152e7d7
SHA1 ab3137f9de2f84b01f1bfc54a982d825d26f8787
SHA512 e4d409b7067c37967fe80ca1aea70fbf928dbba11b806a076868ffc2f96050b0a8a2cf86682caeac5d262d15c6ef36294a7f44ba084b989bc9804c0977421783
SSDEEP 49152:1b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0LNiXicJFFRGNzj3:L3q6mjBv7wRGpj3
TLSH
T1E1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 875da8d1b22ac9272a401e7b7ed1ab1028b7490d2ab870eaa4a5c1f2d40d641e
MD5 7b01ee6af38dd31258b04f73610062a7
SHA1 f6fd0ad42f84751150a7a0352f3c33b03923e164
SHA512 cbdd2bb70bbea4ed67ea50d842cfa05e5a753e729c21c9a7d9dfcadeaa74f4965aab39459ab0e1dce142647c9dbe577553a732325b7bab49a47fcac72f0084fc
SSDEEP 24576:EXYfDtczA7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jtc2LNiXicJFFRGNzj3
TLSH
T11A65012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3063f2961cd7dafa5d5f1d013176f7ded620262de909b1fca90bd86b33b591a3
MD5 0984a5eb462d5b376623a0bab4be3692
SHA1 febc66b25b3f0268405db6feb46c8455cde81aba
SHA512 3ddf0424ea8cf38a2b5edc1cf2a9689a236fffd3264e0062c5066ecaf35eff3b0157c4deda533748628bb2d83c35102057b85f028ff6d23a09f0cab81192b2ea
SSDEEP 24576:z0Le5ji0hmxLrMc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zPji0AZJLNiXicJFFRGNzj3
TLSH
T144859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44e343f343c20ffe6cc5e49464deb5281a31d23c1527f6b5f43eb0491fc7d156
MD5 828dfae3f83576e6acba7560aa0cc0fe
SHA1 d8f44d785d98804362e9e215ce602bf1b7ff5830
SHA512 31c65c5498beb07e4e9c0218517cf75b5aaa0ae8cbc4e994b556fa35eb0645034022444687e3d3fba259462e91ec9914f6ada19b169ff981b3e744a3e6705115
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyuG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+Hjy1LNiXicJFFRGNzj3
TLSH
T163756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 af5c2d8058dc9f463a08384496540dbbeb7af4de28c355ca80f174f743f9d7e5
MD5 adcaf59348310fe59b40eac40e11221c
SHA1 ad7fcf26bc4af3b8cc37f82ef752087708821e5e
SHA512 e2d83716ff3608461c58290c983dfc31e30e78117a807d4e051e6d91ff303ee6037a152d133099cdfc41a47429cc6f7669dd75378097d3d441d70076827e85f1
SSDEEP 24576:QVbqPb88hv/l+B//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QVO88hXl+pLNiXicJFFRGNzj3
TLSH
T160559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f7a942e6ea1738583da5cced8b263cef6d6093259dce8f39d7db165d4e9460af
MD5 3b47795aa4623b03c9ec96691bfe1d98
SHA1 455690c77ea264ac202b3d24c4f1b1633858d706
SHA512 3895168dc06f475ee6d678fae873bba7de6b9a12d0062d1ffd1bde5681ed890b4df6e8345079b9ddda22a8eae55ba6af83df1bf8bc526978c96bddb922d7eae3
SSDEEP 24576:8Zw/TwSfVcYG3K/cJHlnFR+IGNe8j3Izj:7LNiXicJFFRGNzj3
TLSH
T1CC4523D3468854B1FBFD003A867A5828B5845E2C8A655CE3D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 dd72fa829ab57a938179576acfa698557109b62351b0e358431525ae8cc896d1
MD5 32229c2183f4718617d749edf080c610
SHA1 e0aedcee46459a09764ae110eac8cc4310a1a90f
SHA512 fc85282f24191159fab53f96de2e958f0b090c2ae6d7434dc083dc8eb72eee4dacb28e511f8874e3959b84489374b4e42ad0ba0cfaa1a1fff01a8d786360ee03
SSDEEP 24576:2JIUn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2JIUnLNiXicJFFRGNzj3
TLSH
T17D65CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3de98d94452039c5925a544e0a211abac2e5e8e72cce6fac87527724b269f4dc
MD5 0f0be96eb0ae874571fde1d344a4da23
SHA1 8fb44216bd1dd7eccf9c36fb9a086da71966296d
SHA512 e0dd68dad84160c12101d7cba6611ee8316f743188e80c08ab4293947fd8527ad2df70e6f84781807ed7b99c8cde68cda4ed9a4a3475db24aad0fb7918d6ad72
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THD:qQvGAdlCEL8c/WRNw5CW7wRGpj3
TLSH
T1B0266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 21c4a51fe4a6383c9cf5e315236dcb42d1443e198e324a0db762028e65d9fcec
MD5 1631099b8a8b0959a883396b2b1aa207
SHA1 aaa2c7195d5998af87ed705b73ab84a525af58b8
SHA512 44ff0cf073d68b359fee270a6a51e5efb0d9b03c44850fffd1fb244b2cf03bbcbed7c079a355be051898d6b74b9b02fcf38d11b3003bd0bee4111a8288a1b12f
SSDEEP 24576:qxewsAjZ/TwSfVcYG3K/cJHlnFR+IGNe8j3IzG:2ljZLNiXicJFFRGNzj3
TLSH
T16575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1ce3c793ff710759c6d13f10f0910e06eaf400c14f81bf369e9bc8e5aeb67a29
MD5 b610937307eff2c5462c47aa275fc033
SHA1 89a1d8e4adf1a681801bf65747997a387e6a08f9
SHA512 7f1ea1e5171343dfd9b4a5363598e123d0126154428e83701a8948c6a65b6fe741b0aedbb90046965b969fdd326aa36a450149a6448acae7bfbeaa0786605d0d
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH1F9:9UEtQevvqc2W1cpV20I32r9
TLSH
T193474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 015e4b12dd3b4f550769cc269d6976c8471fe1ca63902c9b726b787447c1196e
MD5 6b87dff94920d83f17f2ff59039f81d1
SHA1 6ba72830fc6b8c7646e5353814ae2f8206446ce7
SHA512 64a253e2efc509442c6dabcf09e253702b404900258e6e3321c0c6212c5d6c004865f6dc56dba64fc0bebfcdc712d751c5cf0fd663953fc4ce2b52e4a7b6d045
SSDEEP 49152:1CbRquA/m2yL5zLfFiV+XenmE3/z5LNiXicJFFRGNzj3:ioq2Vjnmy7wRGpj3
TLSH
T185D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5d6d1caa113f6b66c8dcf50e6d807be69a1cf866389b3cacd3ce1abffc4852b3
MD5 d0e50ecf928c3b3c2fdc4a5333578439
SHA1 e2cd7946f3fb43d7dfe4d7b9c889c29539ecd409
SHA512 384de92970c8927937e75c20a7b8926e453d1ba8954665be524c67a5b69d85b80254d92e98af1370bbc8176f37d300d36eb5a85b41ef7b65c7cad80c0ae31240
SSDEEP 24576:+AhGL6IFoiwtA5l7S53S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+AM5Foiq5CLNiXicJFFRGNzj3
TLSH
T156359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C24F2150911F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a7206be8f56f0e4b91161deb1cf687096ab2e6a92afad7aaefc6049b92c76c3a
MD5 4c9efe0f60f34d9065c3af035cec08d1
SHA1 bb23ec70d9540ab92bdd222f50f1fed8f9c8071f
SHA512 ef65965e129227f53f4a26a3551da84a93d2cf7644de24793d405bf9c75a63fa827f24d6ceba3d575cebbd7e83e5eeaa2a3c9dcf2abf7a0bc46da602e6bf1623
SSDEEP 24576:FwuLOWV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Fw4OOLNiXicJFFRGNzj3
TLSH
T17565F18632940CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 b0bfd215efc5fa2db086f906f46ce2a927d7c075205e4338d1b6e9c0d3058891
MD5 46197942517170bfbb08168bc7018b81
SHA1 c8e8b2bcda8632272e7a16fb93975185836e82eb
SHA512 49bde26d27c0884aa141de1e30fc5dbcd4e7527048edcb26ae2c8bfe45d2785bbfa6c8a30f4a1a31bbfd20f7aa2fd4823a2df596ecdbaffaeed2dd2d845c9a65
SSDEEP 24576:uZuE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T15E55129622D420F5E6BB403DC9F54504E3A17C2A673643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 342ccdd729a48f1a659f1cef9da18557d26dd576161b12e8f666cc7055de0ad3
MD5 0551a3f2610b5042ab689553822b1dd7
SHA1 5dee5c4541ff966650c986f6e41b5a9e8c573ba9
SHA512 6cf701087aa3c2e34895f3fcfb44917040bdbdb272bd4420f759b707fe65469f2e6713b60c7eb3c131e2037ee410e7f9d4d9c494851cdafa6b4a37e0f423a0ac
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN3j7wRGpj3:9QyiKanX+PNnF9
TLSH
T1C1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 edc29e4b2181b6a659aafb910b4562767cbe1767c5139ac7111ed3f8a5dc10dd
MD5 62dd990c39d13414a7228c398b3de328
SHA1 9465356335d705711e5c1ddd3d999632c57e3549
SHA512 36382bd372228b2a7a32a6248e6fe2195151c7b5ab89cc54d7b229d7fa4855cdc9669b635f68d15aa13c643a36edfe9ee127382ffaf006fac33092677f430cae
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3j7wRGpj3:OQyiKanX+PNnF9
TLSH
T173667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4b376d62b27de987045a4f0caeee71ce9b5da966c5dffae17727593127e962d5
MD5 fb9fc4ad1c2bb4342f09d27de28c4747
SHA1 557fa102a6ed6a0d9a63041af5098ed2cea5d8e3
SHA512 0d24429e0cbfa5752d363d4f6b1238796e87f99b604f4fe6749d1e2e1e243f1c814d6128bbe5d860c6f044409da97b6226aa85271118a682234f49a41b8ce6f0
SSDEEP 49152:468Qg55nhkeWu7PNU3/JLNiXicJFFRGNzj3:CthTRc/J7wRGpj3
TLSH
T13AB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 521134ab8ce6999289969de1fb3db3e42d37bcddf248d89641457a6ae03c9a48
MD5 1978e21c37c6b13bc99c5f4102794cf0
SHA1 23543a7c00598a37da44ea2c225e6ce089aa810f
SHA512 ce148bb710afe2eef9f810efd34de8d1c720e0b921e799c306d6ce9858d0136bb049d67440b005767be433a95fab0f5f9876fb9a054b0cff3f4532a7944b5835
SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZw7wRGpj3:iLIHRWheF9
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 137791dc79f7bbab3dcc22f978f6125ec52a63fdbaa6c2747e9eb28b8a2d0552
MD5 6a64d573d564fc6a19dc7f715693758a
SHA1 64b74bbe705ab855a63f7192b60463fed4733eda
SHA512 aa2e8070ace8faa27e73d1f487d1e9ce1b7051480c68788dfc3ee4ac5dd55e58df7c030995695b70ff0a62bd7ab7dcb2eeeefa089e134c5f3f262aa4e5b1b954
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glrLNiXicJFFRGNzj3:Ju6JmIxd2dr7wRGpj3
TLSH
T148D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4e04246be4967e23913b2c781f9e69dc422aa9cf5c00ea14eef5c8c0c6de5c6d
MD5 a8195296d30e2d968f794c04cd319359
SHA1 cad2e4646ce1367e35dbff5b95307a37ab719542
SHA512 a1182f05d17841e67a5f89f7e265e9023f3102f1b57e9d2042ab45fd5213d7791619824a4983930b93e617b3cbad5a9845266fe78d28433eefc887716ec6f2bc
SSDEEP 49152:V1hpsNoJpF1A67U44CwH7R4xHLNiXicJFFRGNzj3:VmifPqRy7wRGpj3
TLSH
T1A8B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b05c6d42e00fd856b942839c461f0ec71b6a19da72a37deef159530147259f7b
MD5 1d0c5c573ddc6d94010466dd90be8d8d
SHA1 684f2a259b77bc1ad715a108d4a3f71fd1b33959
SHA512 a22a30126741cd53fd7e0055ee0ae9d119bc112068d72f482d58f85f96b0a8864b24e8fc888b4ae0f86486e1d6cad4a452adf600fb7be5f5e4fdcb98a75aad13
SSDEEP 49152:SSuZQIY0Be2KkRVtOnks6NMHqELNiXicJFFRGNzj3:M5dKqi61E7wRGpj3
TLSH
T1B7C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2b1ee4e169764336a995401e738e98b9a3963c5a308f03f0f7c1e45ea654508a
MD5 5843163406b5ef36a2e2032df270f351
SHA1 8a65efb83d592ca67b03971cae0a3618c1edec81
SHA512 442a39fe23fcea8fd2afda9f86199eedb171dfc8139657a29a02de9608564983cd8b5a86a9cb502ed6fdf5e8819fc66c1119130a6276e4e15aaac2b0a16a86a5
SSDEEP 49152:YhtSn8EApI0figjgiDn0AP5w7LNiXicJFFRGNzj3:JX2iWphu7wRGpj3
TLSH
T1CC95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 14ea9f3b4e61a5717ac83cc8e747e67d7bfd87bfb390b48c9d894342927971a7
MD5 7010e6efd897a185c29d7d837f82876f
SHA1 2ef35b2dcfc78d9be6d7ab451f55d43bb6ae5958
SHA512 aacd249f63a1a63f430a6f10bd211f9cd44131ae74c222e5a955b9325f67cf683aa8520cf5f645491570dd46a1a08a8743db25d421122e1897f7eca07af896d1
SSDEEP 12288:BOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C64523D3558955B1FABC003AC6754428F5882E1DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f5c581adde8360d858939436268b3788a0df1d3094dabfaf87219cb161b5f609
MD5 9c3eb86cffcafe74af5f027e69e7ed11
SHA1 e06fd8bc612440a5fe927e75d7d2e7f95c30ba6c
SHA512 9448ded188021bbb9ade0402ce649eef976b4e895a69020b39b93b67b72d848faefa2fb0b5b3978110a33dc1a8d19b51936b5aebbb62aa71cd7e2d9bad8a0655
SSDEEP 12288:5BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1594523D3558955B1FABC003986754428F5882E2DEB5618E3E3483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d8df5698ed4b7f25e4eb952a81b8dc9e9efc9945367208e05e747849f5ba51b4
MD5 1bedd1a82369a0c1cf925c17fc2028a9
SHA1 a2968cfb2b835d7c503801da29e6c48b027caed7
SHA512 8b95a9aff7fed8a67cf72da7f3b699c48b5015d26058c16cb1eedbf5acd087f4a2b1c63a01e743e3ba2f4a286e8f2ff69e64fcc5f787d80ec71d6c771c089812
SSDEEP 12288:r7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17B4523D3558955B1FAFC003A86754428F5882E1DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2c6003a934fe62f4866eec5da210f3ef2593907281d77c7ee19da22fcaa8c4de
MD5 903c2d97ad4b85b97e062be2009a0cc8
SHA1 cd580d1ccca5d00fcbd012b2c47491682e953d78
SHA512 823dbdcc5f8365e508384a50a5724733cca0c6dbaa46a768afd78c98057bfc2ba7d4dadd58986ae8de6db03948f9361c62f823aed1c1c5dd5215b9442bf3c571
SSDEEP 12288:HVgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T107452392168900F1E9FD8039C6764424F2A47D6CDB365AEBD3003D0E5A75BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7bfec2edfe23061cd9596f5055807af67cb3cd721703894992cb23191c5f6174
MD5 8cb21974f98faf19f86b9f403b32401c
SHA1 c5c323b8c57dc8bf0909313c25e3b9aeeffe32fb
SHA512 f3a3831ef791f899cdbdda496d785ab7122547750034339fcd898730fd1db31abfbd48461b850e342aabbe50580e63c47708ae73fe76c7bd6c01c655e3f3a436
SSDEEP 12288:mYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F4523D3558955B1FAFC003986764428F5882E1DEB5618E3E2483D1EA278FEBCF3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f37d81fec1b9d741f661de1d0c0e8dfcc9936455cda30d6a80dbef0b7ef62cd2
MD5 684e43c95a8ec349c4ea317b4707f1bb
SHA1 5da615bf45cf75cc83e4de36802e1e1e2876d796
SHA512 12a8c2166c75fb55243f4dfee5c3d0a812ffb9abbab97b0760c7999d6f54734adc0af48afd5f21513bebdab7b5c074b6cb1a74dc8aaa798d12f26a1e3ad8d56a
SSDEEP 12288:L9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Lh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1284523D3558955B1FABD003986754428F5882E2DEB5614E3E3483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 96b5fa19ff2763b9f52d5caf83b946cef3394afecb4ceb9395647c53a0434cd6
MD5 f9d461522d0ef32e334bf0de759ba01a
SHA1 9ccba15160d66ba8b686fc8a89d29d11a22d6672
SHA512 180598053f83411eed5a8a49ef79f29cddfaa7fc8c1aa5f7f94c2e0b88db3233616ffed77dea37dd51e91d7111afd4b2025a8d921745af698539f9810d765ddc
SSDEEP 12288:0ZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0F/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1184523D3558955B1FABC003986354428F5882E2DEB5619E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d2e084e27545327553dfe53819773581f91f2617806b4d89d8cd90a7214ec0bb
MD5 4629611cdfa33462df7c3b963b0f22eb
SHA1 549f4530a49ae66a88606fbacab02356000192fc
SHA512 e29933d9d7c6b812f88adbbec3bc78e7a9bcb3d781f205db3c087c49064afb0e5f100d69ef7f325da48f0c75caab6d84d6a36d9d3d2f17f46555efed61a18479
SSDEEP 24576:yZMhzFVSON/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yZMhzfxLNiXicJFFRGNzj3
TLSH
T159650295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 459b56fd459f9dfe137bf38b72e9037b591609bceed5e46b27c82f0e22e8c3e9
MD5 bd9f2c796030158498db8fc1e3b75dc3
SHA1 1ba518a4de128546b0051b9b786ba9dbab40fbfa
SHA512 ac4693a6ece53227b6d2c5bd796499aa55cd3a13e37d557d3c3dfd17742e153646eed21e9aff6f507e2c8476e795cd1e2764eebfbf93bb791e2cab6d3beb2722
SSDEEP 24576:KcP4mcvIjkGOxhKP2l71nNKbrh/8KBM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VP4m4IpOO67W8KWLNiXicJFFRGNzj3
TLSH
T1C365AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

llm_user_input_extractor_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4624_492027056\llm_user_input_extractor_config.json
Size 4KB
SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
MD5 7736ccfaf720ef9b0db919dd01c4bf8c
SHA1 24b48ec2dee093b8e4384ad1e25ad8f12af0831e
SHA512 f044ed3b6fee483d211328df83f26b98dfe47890c05409c65c7f7333fde1fc043cd1c05d18250e8ee8731f355c13b3a0aedc0e60b82a26c42a7f209a69ad4781
SSDEEP 96:a0y3Cmyjw2w61skd7GZrlWqPZ96vOim87Ai:wyOy7k5rx0WVS1
TLSH
T11F91DF3BD8A15C2B00F3B225B87A7642F534A35B27C05C5B7A7C5A1C8FB6D312582F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4624_492027056\office_endpoints_list.json
Size 9KB
SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
MD5 30719122f9edf4e23019a3b74e4f4325
SHA1 6707d64052797b9c5f1a5ccf016e5859c8ef898b
SHA512 ec2e1a33fcd1301f282512ffafb611ea705dc5df09d9aee014276909c1b62b0c73600121d94e9b6d9e160296672b41f2cb8c3ba23f121244ad2ea6521680723c
SSDEEP 96:DdQ/JJvwjyUsrdfsysVsnQfbJNZidYusysXYs2sFsdv12XvlRT07s/DkhcrHPglW:D7d7mfgiIWRcV4sobxezQd1Y
TLSH
T11512BB3BC4B49F229AB060659705E244F13C43BF5600C6FF76B9829C1F366ECA58E1E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smart_switch_list.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4624_492027056\smart_switch_list.json
Size 2KB
SHA256 d490aec3403b2daa86aa095db121c2dfee0a35c3ed0770284c0bd0e0a103c776
MD5 a55a23fcdd9af97d33302c8e6de41c18
SHA1 00d9137cdffd273ef849e1122ecbb6f27b6e8423
SHA512 647c19d83bf4db3c4b868738df3a8da0b06f666860f468a2de6863e440800bd5e4057ac03bcae4b5bfed28a8907038bca6a72785d42e7acb6f56580a6859b05d
TLSH
T1E4519EB7CA215CA005B482B16338509AF82827BF62C98AEF377D5B1C3F744B425981E8
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4624_627618444\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4624_736508711\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 1a659c1b0298db3bef3066262da6c0156b1728c953add46f02338218068641bc
MD5 a40d2c95857ec28d04cf97414ecf34cf
SHA1 519eb066efc96128585726dc2326e1b596573c59
SHA512 79b49eafd37bc4fa7c558d0a2f1f1da1533f8ed14a9c1afff847bc7c5afcd3ff2a2c6e740bfbfa05955be740c05f61ac577281520b9af1b40702227f8824d63c
SSDEEP 12288:J3sfCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16655F15AD28802E8D1AE5139C7664900F3633C2997E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17fe784b-ca39-473d-806d-1f15f8cf6996.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17fe784b-ca39-473d-806d-1f15f8cf6996.tmp
Size 8KB
SHA256 bea987fe85bf45d20c5585e848c20d60e7f95a4ca473a0c92e7ee250cd422013
MD5 a9950f3bc836ffb3061650f77cfc1b7e
SHA1 dc5ae7f62273eda54c205d3847f371cd4bb9c6a6
SHA512 e4acd57a8e0b8d1985d73836584f7657246843fc085b07e2b8b887d4297a3f0cafe6b43ee6f52cd387641ec80be8cd9fc707f056af7e3d7c62b51a1bf0d5a318
SSDEEP 96:KqONkTQsjpfbUmjH5ih/cIPURHl8h4otop52aD0BKP4v+Y1xf//ojd6x/eYzRtIG:BONb6JUm0QmiUyL4so//p+8BCMNEOU6
TLSH
T18702D739AC68BCBB8EE3AE45F5477B239FA4107B9A955F84DAD81E1C01D725C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18360ea1-d114-4d38-9679-616e04ba22a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\18360ea1-d114-4d38-9679-616e04ba22a3.tmp
Size 18KB
SHA256 06b4877d71ff4e0b0aab24710473de3ac08bb35f4695de8782abc10c890740af
MD5 502f1516eef3b0a4d9504ab39cf97c2f
SHA1 b2abb82ef87ad8f7093e7e6c1193044b6149724d
SHA512 bd5c35f5e993a9bd7b4c4f518cd3652de64338b0ce472faec4f5a11ccf362651846b29d11740d6e3e1a2e238fb174b915c6624b5ce8808ab9bc2a965c2e79f93
SSDEEP 384:nFQkUSv0sN6XT3bzTKh//p+GqicH7vBEDtBIIlS:f0trC/hZcH75EZBL0
TLSH
T153827D71B86AAC3759F7A250F1463A63EF7460B7D9C40F94D9D9DB2C00C62982B4BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20287488-8a06-42ac-9757-6136d0379097.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20287488-8a06-42ac-9757-6136d0379097.tmp
Size 8KB
SHA256 802772dd23f3cbf268a9251ba0ab5c9b41a75ed8e4a6cf0d454d864bcbc5e3f5
MD5 d784ac5c097cdb559d192e2e60a498ff
SHA1 a1d3c63dfb06a0a74372e3f0f4ce6105c859e63f
SHA512 99605970f034bce36c6bab5216566f6dffd4a2682dcea3f5958259037f6bede7e866edf4e32431846f0ccdb320a09fd02c0e921ba602a075b520899ecdc54ee3
SSDEEP 192:SONr6JUwQmiUym4Wo//p+GqLoNxMNEqeyU6:SONr6+wGWo//p+GqecU6
TLSH
T149121835B869FC371DE3A151F48336639EA420B79E854F94DAD85F2C05CB2AC2B0B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

568e7fc4-dbb6-4eaa-9ac6-2d4ca2ea63ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\568e7fc4-dbb6-4eaa-9ac6-2d4ca2ea63ec.tmp
Size 14KB
SHA256 51b70653690f66f2a7fc14db9d5d919eb73950f48e6c9a01d2cb2ae8cb832d2e
MD5 9f0fc627cb2f214b91a09bee6c937f2a
SHA1 8b92f65fa603b50167207cfb5da389c315cb0bbf
SHA512 db9221d21a54645e164a4bb5ed215e219c968bd959aaf2d8c5e88666b1a926fcba69e1de9622f6eea2596fab0d8eaceb3df9c0d458728527e63fc3162fea8fc9
SSDEEP 192:uuwLsN6WQLcFduUbIyQmiU1FVV4h//p+GqL8aoMNEqeyZ57vBnEDFjRgL:nGsN6WT3bzFKh//p+GqicH7vBEDto
TLSH
T163624B75F83AEC361DF79244F4473A239EB420F799840F94E9D99B1D01CA2A8274BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9f5375d-a965-45bb-9274-2eedec01a133.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b9f5375d-a965-45bb-9274-2eedec01a133.tmp
Size 105KB
SHA256 e2d1a78ddd4a2613e2e137a9b8a6ee6a025f24ce78c71783944f051445e3063d
MD5 a68138180bf134fe6e360a0e37c3184b
SHA1 359c64103a0eb1cbba384f963ad47bd6cac7e41c
SHA512 a8338bac44852d511db583b349822cd7e5ec3c426141655b68ecc184832731c5830c69e5af34998dd6e85c0ddb2400530e818deb283053d561c8afc2b615cacf
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
TLSH
T178B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

039c0095-df90-4157-898f-baaebcb7bdd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\039c0095-df90-4157-898f-baaebcb7bdd5.tmp
Size 10KB
SHA256 674d3da001422c1b2329d7a0659c43599f6b05c890437d442ce10f2c93d96ac7
MD5 4203f49e4b6206ed950f34a2a9608e55
SHA1 be87a75184942b4ba918abfe12eb06ec312ae10a
SHA512 81cc7bca23aa93e403bbcdaffc23dda0f2aeb45fdfab3613048d98ec37ac605ccc0e86b04fb4668cf76d634030e1d5b95e4c9dc1bed2287b363943daecb286e3
SSDEEP 192:sxZslsd/fFXssnKtai5nIdpbaHW6+WNgKH4/Y36mggyPGIg5pJ:sxZsqd/f9ssK5KmHb54/XOB
TLSH
T1A432D892AE34B93B5CCBD219BE15BB13D6FA503291C41E44AAFC961C05F67DE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

454a6072-e317-43de-a3c6-2c68d02789b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\454a6072-e317-43de-a3c6-2c68d02789b1.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

48b9e998-a39a-40e6-a3ba-b5eb038ba537.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48b9e998-a39a-40e6-a3ba-b5eb038ba537.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d46ca32-23cd-4241-9b43-455e72c46d3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d46ca32-23cd-4241-9b43-455e72c46d3c.tmp
Size 10KB
SHA256 930ec2f8e7468de9a7f03a5d50c2cdac8ff54853ff8b4d11a44d66451fdd40ac
MD5 3c146400c772f41c422a6c3106c15985
SHA1 6895f4f1f5ccdd30342ae4b6a65490eedab7652c
SHA512 64622a204522d9f7214c21309857f14968c441ced8493ea10ffcda1a0e96e390bbeab1ac4323c293f559e7da36e467ba1f6ab4a7c86045cb7549dcd2b2caf63f
SSDEEP 192:sxZslsd/fFXsGnKtai5nIdpbaHW6+WNgKH4/Y36sKgyPGIg5HJ:sxZsqd/f9sGK5KmHb54/XMT
TLSH
T1B732C992AD34A93B5CCBE219BA157F13E6FA503291C41E44AAFC961C05F67DE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9317d251-64e5-452e-a904-ad2bc32483bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9317d251-64e5-452e-a904-ad2bc32483bd.tmp
Size 27KB
SHA256 ac67ce94e7185f498e16923d2ac5e5e5ad47018ff47a3c7f49ac911f274e7951
MD5 dea9307816b06f6d351d82d110e4df4e
SHA1 18dd9027b52c3bdd839364f44e33b6bd4ca100dd
SHA512 1d32c2966381324ce764c1513347828741e5446777850599087b17380fa749980c749e2a8aeb5a52e9c7254238f5d75368f64885e6e40fd10dd3ef962bb9eb25
SSDEEP 768:ZxKlm+QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/LlpPs/Groxqj:ZxKlm+QWvUYe0u1jaA/L/E/9xqj
TLSH
T115C20A3B640CCB7E4FC04A9DDC5A6F976EA802C796588D404BFA994C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c6c69a14d8a8c7f58eff6cbd0a58aa414845b6ab87afdf6b4d3683868557cfb5
MD5 d2fa27870ab347b8369206005d32dc07
SHA1 e48f269e6b79a07233641d8c6d268d9b1d103c99
SHA512 79fd7dc3ae4ad35fa79da31d8e31602a72b0c14725d8dc441a3cbbbf8dd1b85bf268f53c74caf5d0052395c8962ad6dce40273fc4d451072a81d7f2ae1889bd9
TLSH
T194E0209515C4CE3D7144745701A8B70CC6D03A6F93C4AD5E1740DCC67445644F7E5660
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1cdd8e33e4f2621ec88480252d111c0a0d672942704381f7eb8cf46a8f282425
MD5 e0cc5dd193bd2808cb6d3daffe3e1301
SHA1 4fa8dfd46cea7d30b27c57979aa8ab0aed8ace7f
SHA512 8ec4264aed0b7dc1407e4c2f67bba95188edc99e03ee547f4984003efb98ed05a0c29d189f58004a30e74565fbb96fc2155064c19785d58b25bc8e1fcfbcb80b
TLSH
T1E5510AF0319741E4F7A85273A3D28457357095A050A70F6230FAF5B95DCB704D8EB86B
MD5 SHA1 SHA512 TLSH

Submit Download

324d1d1d-9c1f-4d70-8d4f-e1004cb46626.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\324d1d1d-9c1f-4d70-8d4f-e1004cb46626.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

3125df6a-d9de-4e0b-8e9f-318c88213673.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3125df6a-d9de-4e0b-8e9f-318c88213673.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

91cfdbc7-e0fd-4b87-a823-28048c3378bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\91cfdbc7-e0fd-4b87-a823-28048c3378bc.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b59b1430-d00d-4b1b-ac8e-dec3b104e0d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b59b1430-d00d-4b1b-ac8e-dec3b104e0d3.tmp
Size 2KB
SHA256 28ff9ea45d3d26886aa375f6dadb262c7685de8eacdb264ba784b03c5294b2fe
MD5 3dc482817d5e5bfcd4861cff479661cb
SHA1 748f88f9686b0c22338e8b08978e26346532d388
SHA512 d820ce8e1abff1054610707f31e135a904dfe8921ce98174d1f5f70cd749f9e2754a75cc0ca95b60e3da2587bd3953f2334d4dd41fc0e26b59209fae057374a2
TLSH
T15E418BF3C2E9826DC94156F4AB147E2FCE2D0954832C3D5AC8E4AF5F93E2471E24165E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 92c8b315e1946a0064eadc3673f84930a5501fe74c8fbab568d0b198e107eb22
MD5 62f6d25d683c38d93d342d4e8a951cbe
SHA1 95f28ec0b6e30eb4a9ff84393c0e526a721a5269
SHA512 fd6ebdef34d0c12bcf15ab08fa191ec13e182e5bbf1f28009ae40490fc858a31e5f1048ced103a924c24bd9f74cb0ab521489f80415ee0dcba8d4f02dab6bf8c
SSDEEP 96:KMkQKxKqG3OKMMHr4v7JlZgFdmzTTgK71TRgfjTWxLtq+8KjK+:CvpvrHd
TLSH
T1ABB19550306B02513DBD354852759A2B8A8230F6702DFA7F7BBC98E64E6AF105EFD5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0e0f6a6-b4d2-4ef8-9190-d714dcb690c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0e0f6a6-b4d2-4ef8-9190-d714dcb690c3.tmp
Size 11KB
SHA256 5f696756d4620d8bdaa1a1c189aff05ac35b96e5171882a1838c86c62ba44ddf
MD5 f9cd3d16af55b2f2720f5fe028745c84
SHA1 cff6640522065aca97809751675ef8d63ebeb5b4
SHA512 eac395a59d69aa8f1d11f288c350980162371bfccd2f59a4a1e0ff11c7503f219e7e7ba3a95747b67e352d4f2777a989b1cfd5e312b4e39b6fa36e1a94639f80
SSDEEP 192:sxZslsd/fFXsGnKtai5CMIdpJaHW6+WNgKH4/Y36/tgyPGIg5HJ:sxZsqd/f9sGK52wHb54/XYT
TLSH
T16F32D992AD34A93B5CC7E219BE15BF13E6FA503291D01E44AAFC961C05F67DE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2d6b92e-3e37-4efc-8b6b-ca37cc331b98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2d6b92e-3e37-4efc-8b6b-ca37cc331b98.tmp
Size 9KB
SHA256 4981eed47fa26009ed9776dd338cf5ac86ec0931383d7dd33b0f3b284b9ba70d
MD5 5578a0ff2ce9daa088e2fa6bac6874f5
SHA1 e2be5a3e86f4181ac68e42d874decb1006093d7f
SHA512 df38e4ba0ed9c59cf394907a5e7e29cee95d46699d5c20bb88ecf2c5e113f57e3853e1149ad0401f0051007cb89702e369cefc208913637ffb59b994ee45304e
SSDEEP 192:sxZslsd/fFXsMREdpbaHW6+WNgKH4/Y36mgDyPGIg4J:sxZsqd/f9sMamHb54/Xfc
TLSH
T12E22B652AE34A93B5CC7D21DBA24BF13E5FA503291D51E48EAFC961C04F66DD224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c373ce1-6edc-4a4f-8c6a-2c5a0dc6ab6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6c373ce1-6edc-4a4f-8c6a-2c5a0dc6ab6f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.7\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

bee65025-a55f-4a99-85a8-19454cbe5147.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bee65025-a55f-4a99-85a8-19454cbe5147.tmp
Size 23KB
SHA256 922b0ae0f297d959ea235f07041106c6cc5eb7b21603df0f40d52124fdb300e8
MD5 5cbdf33109c180b94cfd6fb2d65238ea
SHA1 4fa565436709e5ca37a7264d203a5e4cf8377518
SHA512 5c34d15673e8fd12db460584016d335d856abc5df2edf3ff19f762d8f4ef605867081720d457869696a47870608d6f128c5f9aa82164a89dd43cb410345e2923
SSDEEP 384:n1iFzQkUSvtzsNC8TUNTUlIlXT3bzTKSDfpa//p+GqecH7vBEDtBIIlS:8FdV3wgFrza/hrcH75EZBL0
TLSH
T1EAB20676E8A5DD2BADF39781F6063A97DEE010A389C88AD4D9C99E5C00C71ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01bfc22c-2834-484a-9fa3-aaf409f13902.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\01bfc22c-2834-484a-9fa3-aaf409f13902.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

06cbcb9e-a766-403d-95c0-d6e8329de81e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\06cbcb9e-a766-403d-95c0-d6e8329de81e.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

143d96ce-0f02-488d-a754-0ea2ed56b642.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\143d96ce-0f02-488d-a754-0ea2ed56b642.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

f5d28cbc-e7a6-4a5d-96f9-3933217e356f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f5d28cbc-e7a6-4a5d-96f9-3933217e356f.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

1749a0ff-3588-4ac4-8b79-4327037e14d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1749a0ff-3588-4ac4-8b79-4327037e14d0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fe6fcbbc-d918-418b-9f54-794a73891c04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe6fcbbc-d918-418b-9f54-794a73891c04.tmp
Size 18KB
SHA256 bb0d5fac94486fbb0d800695f4589faf92f26ca8d6812bc6d15d1df9a3b28395
MD5 a2e71ca0bf7243b8c562b997ff23ec67
SHA1 82753c3a1e4de58d732ea0c7f14ad6dd3cdad2a1
SHA512 61aa0ef7cbda302766b805fb68eadad7a9c21d1407ccf5ff7b0256dab352163147f47531b30f0115e5bf5721295fcd939560779866dcb6f2007eb9397e27dddc
SSDEEP 384:n8QkUSv0sN6cT3bzTKh//p+GqicH7vBEDtBIIlS:80ErC/hZcH75EZBL0
TLSH
T1AD828D71B86AAC375AF3A210F1463A63DFB460B7DDC40F94D9D9DB2C00C62982B4BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d38db026eb0170ad132d39046371c8175189f87630c50a5c3e06eec692b2cc65
MD5 619c3369e82a931f65dbffb0c37faf60
SHA1 19ba0b7700bc2ac398e96ba4780cd8c553054f55
SHA512 a8a41940bbde37bb6d94d47dec6990ccadeb2ff7d04fe11b2f36a8a074f8cee6a8a15a73b8b71401d2de0367d0636d25f5b390984310e50bc110c95f8aad7879
TLSH
T165412758B6E91148B3B76E5AABF7A96D483EB9372F0B945E00110D4F0A73B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

8cdd76f3-e957-4f79-91d1-bcbde09599b9.tmp

Path C:\Users\Admin\AppData\Local\Temp\8cdd76f3-e957-4f79-91d1-bcbde09599b9.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9186a5b4-ccd1-4ffb-9e88-66289a95cb92.tmp

Path C:\Users\Admin\AppData\Local\Temp\9186a5b4-ccd1-4ffb-9e88-66289a95cb92.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_1017343983\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_949348742\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb96b66c-ddf3-47bb-b753-a6088cfb85eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4624_949348742\bb96b66c-ddf3-47bb-b753-a6088cfb85eb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8e2288032a37015db412ce53813ec65dae9dd5787e08a084cb9a8a55d0c46117
MD5 e3586fcbe107dca0958b8a6469048000
SHA1 888a7640fdfd1a3f4aa06e0a051568fb8687f355
SHA512 4a0fd44d77bb8f0a6869fd47cf5c78af482d0260a1f79e03d77ee1c75ca408bbc6de249ace80daee2c12b466ba82f3ad16ba1f6aeb15dfb3de2c1322569aee7b
SSDEEP 24576:Ik/TwSfVcYG3K/cJHlnFR+IGNe8j3IzH:IkLNiXicJFFRGNzj3
TLSH
T12C452393928C55B2F6FD103985368438B5497E2C9F5598D3E2043A1EA238FEBDF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e1ac6c0868918d3a8322444ed9ccbafdcc40af1bfbe402b498f8b7dcfc820f7d
MD5 d15d075a8d5adb61713299d241796f78
SHA1 e7690f7a930b384981960eb22bd87721102e5e9e
SHA512 ca10742f86f9447cab49820520c89df9ea046378001c579bbfc520a6d53ae8e6e445998096f8d0c324adda4530fe41a8592a45fea03cca050db37b0f50b489c3
SSDEEP 49152:La0h2GEkuAe73q3pp46zwwQqLNiXicJFFRGNzj3:La0hNYG4JwR7wRGpj3
TLSH
T1A085AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.2MB
SHA256 37cace91b58b05cf897531463400d3b82220bf956db6a532738bdd57be6bf885
MD5 2dcfd80c4d89d4608b7931fe2eeabac0
SHA1 7a5615e27003d907da2e63a48460a89a4b686018
SHA512 74f0ea14c849023e15afa13e442d7240c50f2652371037d6aee825dcadfd68606b6728c23050f496ad4998e4423493f55d02e6eca34321e29cab5a4cabc83d5b
SSDEEP 24576:hhbHjPd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hhbHjFLNiXicJFFRGNzj3
TLSH
T1455512BE169C20E5F6B5903D85668409E370BC29172197EF6381523E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 a4877aabb109f81566c5416f95d0c315db2bd320402f20e3eac9e86faf48b07d
MD5 80053aaafc06262a5d9b2ba5ba3994e0
SHA1 2a88c46e6f9f2f5e06ae555c99f5587baaf5e0b8
SHA512 7bd953a8462b701de3700a380c7b09b85dacf5cee4bbbbbe9a95bab754b7f1156c5ff06046142f4c9db2ac0ea7b3586cb83b2f0eff47040995955c41ddc8c3ed
SSDEEP 24576:L3YgnJcRTk4yti+R5dBR/V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LIgnaTk46pBR/VLNiXicJFFRGNzj3
TLSH
T18245B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 afe1389e3895007da7ed0bd1c504f7846f9cbdd01404b132eeda94d1b9ce06ce
MD5 d79f3c71569d359ef8572467ea1b707a
SHA1 2edb31c2dc37e952b05405270f79615a37816b26
SHA512 e194ce6047b6b7461a1a58ee1af55bd2e499ca29b88479c0ed3953d8eb088dad0319efe38978b8d77e94b4936fca67b7973873b471afcfa465ce9126a073da72
SSDEEP 12288:AmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1964523D2518955B1EAFD003D867A4428F5842F2C9B2619E3E1543E1EE278FEFCF38166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 95541c97788d400ab6fe9c53c4e9dbc05f3c65cdc72656b8e7bb7456d270c3a8
MD5 2137e6c41987595bbff4a46a8a80a1e0
SHA1 5e0b903e90845b1ce31363decaeacd1c196af970
SHA512 b0b1533fe1aeace098838b886305cbd4f64d573c6862bd58f23839b3b49514ce322443341587f7cb24c21d4dba56ac62493c6c851d5f1343402afdff6caae832
SSDEEP 24576:+iL3UT7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+iL3UnLNiXicJFFRGNzj3
TLSH
T1B7750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ef7c073bab71297347ce414440c98d3b04bc432c0d45cb4a9c83ddb949fab178
MD5 5eb5d35ad710ceb05048d61165de4117
SHA1 489bad876a984bf8a45ac43979fcd8ea7f432272
SHA512 eb06398a01b3fbbdfae991a7dbac42b3838c3eaceea9c4651ac599c9043f90c15974e094d042b104d28feaf82e891b3fae6dabafae19871181d075626aa37bbd
SSDEEP 24576:JOH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JOHLNiXicJFFRGNzj3
TLSH
T10B55126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 20e01860e4326369bb9b0bb01cb18bc536e875bf4865869d2d0c35f7336bebbb
MD5 60f64504e42390e6c4475e2af71c090f
SHA1 c16fca05a58b0b13155b6854fe7b56c6e3ebbdf0
SHA512 1e4c2765ce124880a7013282d185e43e580841548bdd30565e4bbb6c92c16721876a528ba3ade1cfdab9e2b5b12c9fd4992cc94b0dda7e0cae3b6553a662817c
SSDEEP 24576:k7NM9YqZqmWMUkPjZM48Mv6bEhsU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k7cBWMpPjN8DbEh9LNiXicJFFRGNzj3
TLSH
T10B65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 56602013da1f87a9f038d3beccd0ee1e6c796dba22c3e825c60e9ad6c7c6229c
MD5 7dce8d6a922b1d8a15cc6dbc8696b627
SHA1 33420a8f75ccdd8b3c21727c2453eefbbeccc683
SHA512 c7d668c792cf238c3faef4cf1a393d2912ee9b72885229948790abbe05eec946b8457182b6c3908af2dc24c56221ce04a672f4ece43e2f31145cde99bebf5ccb
SSDEEP 49152:DF2YuHNETovAvNYf8km0LNiXicJFFRGNzj3:y6BCf8kH7wRGpj3
TLSH
T129858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 e49deefe14daaf164e58d2d10bb8e22bae0fda95c705f226a596835bd016bcad
MD5 8a7345bd6d44861bc62f035582096e23
SHA1 c8fabe74879b4d978357ce46d6acfc8081ff5b28
SHA512 ece571fbf725589a07d760abf1ad39c55a1efa115c3ceee1226217102f3e988160d90bf0222c6ea2f09b390521185afba87fcbbdad5723f9327a5ba9430dbb6a
SSDEEP 24576:+AFs06+Omlf8NXEbToD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3Fs060loXuKLNiXicJFFRGNzj3
TLSH
T11565BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d067e7c6ddcfb71e63cece8f279013b1f4be13b6d5c9ccc6d01817dddb425c30
MD5 47f7596aabb0f58b1f4fbc232b3434e4
SHA1 15b4566c0f24555d48bf6bddf2175f8c15b72118
SHA512 56da8b184a909dabe355cf2d507ff3c3d118da3f50c852b4ab6eaac26781e6460a399895aa633fd433c4a45d6ec4457481e04c3a1250e6c618a2663ae040fec7
SSDEEP 24576:fJnJ5D3W9K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fJnJ5DG9KLNiXicJFFRGNzj3
TLSH
T1FB65D02DD2A810F8E4B7C274825A1A55FE72383D2F2269C724B4D5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4aa976371aee5a09ca870d9c3614669ae4906573159563354d9028a9b68f3502
MD5 f4ea84c8ada8e6eec4e7855f134676e7
SHA1 0bdba6e1485f554a9153ed51df8c9c51e3a1111d
SHA512 82cf7ebb980fceb0291e2e26b72fef9f08b5fba5afc5ec78c7b477a09ae1b8b8d0c723822ed8f9a75e8800d48d380d7aac2a47b6e47d7213c7bad948c96fdccb
SSDEEP 49152:hg06DIKdwc+eQnSt65aV4LNiXicJFFRGNzj3:q+7wRGpj3
TLSH
T1F6956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 b8ff1b9885f3945f30d46b238511b3a2966cf11cbc0d5a3dd52eb4da2df8ea57
MD5 4577fc28885662acc1d4602049dbe964
SHA1 b77fb98fe5c4dbe394d172b262ebdd022d6e735d
SHA512 65f58486c7c2aaf0e1fb333c29339bb7bba4ad3a0b0736513d72e7fbf55ba10099719b61e98931a8f90b73acf10acc7e26bf58a3b3fe6635df3b47cb12236844
SSDEEP 24576:qxm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qxmLNiXicJFFRGNzj3
TLSH
T1515512AE278C60F5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 40770bef59abd3ea585f32a26356a01350ee64199a05b337b126eb82e03c02d7
MD5 c95bcdbb234c6bd20e27611ccf5c2249
SHA1 f2226462e4e71262fa91ceb213d200335d25a925
SHA512 acbb8be2a3a5cdd0c4e56211d6a90e5516ad8ec815c1b5035968e82f7997b8df75740c7831dca5e475aa12c2d645cd1476848dc501fc2bd6a09811c61ceef4d2
SSDEEP 24576:7Iyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7I6LNiXicJFFRGNzj3
TLSH
T162551245538850E5EAB9013CCA778064EA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 3798ca230ac542ac92395c449725a51346090bb70afcce1538891c5fa2b70707
MD5 f5bc139e61b84fef22f4f9c3bb9e73fd
SHA1 837ab37daa6596e79ac9eb23faf331faad48a146
SHA512 ac9be67824f47be423ee6ab11518ad24c93f2f7a8d23bbc7d47a2caf877bcbe3c27f952c0b6d7a67ed0ba472f5bd59552d57de1b7f56ac560f200ff6df176f48
SSDEEP 12288:/1jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15945239A118964B5FABD003D86354824F1943E3C9B2618F7A1947A3ED339FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 c4cb44e5d7cebe041f4d73f8cead90cd3d480b78a36fa5c5fb08f5190b9b8bf6
MD5 0cfa086656cd81c7a4de94ae6339d54e
SHA1 0045e3f4abbf11dad5f7c4c7f1f76be2f4237d7d
SHA512 2ac6ca8679330e2532032ffd9ca16632fd15e65defb3b4970c1016a8d33a6698bee219531381d6b7c7836d0ba1467deb9a715272a12030d7c1f1dda4ffb35457
SSDEEP 24576:YQ9MxZKdcz9dw38/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YVKZ8LNiXicJFFRGNzj3
TLSH
T1CE558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 a03eaf610404f05be0535e37be9c8556e7b9dd371d3fc6c409319280a44107c1
MD5 6cc0e0def4d75c88489ace148858a3c0
SHA1 b9f514489e83f2f35cb82b30b4186f439b3aa949
SHA512 889d0f8079e6e8a925855f98b568cb265a1df91130fa0b1a3d2ef0a2fe845b2bfb9b0588e92ee5b6f81ba2c7d8da12d8a253c33fa64ffd773b1144987cde10aa
SSDEEP 24576:syocRApZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RocRApZLNiXicJFFRGNzj3
TLSH
T13765E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dc8974dbe220d128e2cdbee5594f1bf24d24953153a3411df0783c3151f45516
MD5 47b5aafee329e5be049a815ce6e1eeca
SHA1 128a7f6baf2b280f7fc41bbe058cff22fae45cc3
SHA512 9cd3e49f836d15b3aa2d8df73257e8d8c1f389b39217ae434ff5c5c807918863f6e47425d659759697c3b1d3200af69622de5eec565fdb0156687e5c4e3b89f5
SSDEEP 49152:VWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKZLNiXicJFFRGNzj3:F0zuNI77wRGpj3
TLSH
T10DA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 36ad8abdce5b90a780e171cafd51beb71b389dbaf29d27a1926470fced57b6c0
MD5 cafd2ea97171c2ff10ae037077044e40
SHA1 06333991afabeabb748f70d82b291bb7be001c50
SHA512 eb3d5e03bdeba6f5a1df7a843ff394773c8a4f3b85c724f393aba0828622011b049c4147b849f1021dceaf852060daf0da0d44fa36d976ce0c54a4e95827bc81
SSDEEP 24576:91QT7EcpfxR+N5AWAz3ooiYzjMqbm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ITDxR+N5YzTBjMnLNiXicJFFRGNzj3
TLSH
T15E55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 f1affda5100c3725281a481d4f01ec5878bea68c260f15227281da693a507cd4
MD5 8b9f1adabea09a61ea1be7e4249bf066
SHA1 a0325cbbcb89b798c093ac636a2b42d1a9ee8093
SHA512 16ccb440c61e6b264fc7e117953e080549c8317703e67538bd542fcab86e396d2c86500484e747fd74b6683db6284af42e328a6f2532df95413566c06b20e336
SSDEEP 24576:xTMdOz0FFS+umSLy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:70K+umSLyLNiXicJFFRGNzj3
TLSH
T19D65E17EA39D14E5E47AC17DC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.2MB
SHA256 d8b1f093fb324650ed50608ce542a13e91e6739a6825aff04f787e90234ebcfd
MD5 491a4c8acde84c595b41f88c512088e8
SHA1 5a996f070c3239566803045249f40d9d0a82325f
SHA512 2f857f13be3132be71b66916060ce923c160406018e5543cecd4f14adfa1cd46a3868dd2dda635dd90c5ecce5bd7be10f7ba18630543de0caa2a860f4c775ec5
SSDEEP 12288:M4oPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A55125A13D830E4F5BA51398A364014E260BC3957251AFF71D0EA7E9B36FD9CE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-107-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/556-11-0x0000000140000000-0x0000000140145000-memory.dmp

Download

memory/948-42-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/948-453-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/948-451-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/948-48-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/948-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/948-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/980-24-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/980-108-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/980-15-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/980-23-0x0000000140000000-0x0000000140144000-memory.dmp

Download

memory/1168-168-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1168-400-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/1216-208-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1216-192-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1216-470-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1216-913-0x000000000CEF0000-0x000000000CEF8000-memory.dmp

Download

memory/1216-251-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1216-172-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2608-158-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/2608-85-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2608-91-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2608-93-0x0000000140000000-0x0000000140146000-memory.dmp

Download

memory/2692-69-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2692-149-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/2800-0-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/2800-403-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/2800-1-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/2800-82-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/2800-6-0x00000000021D0000-0x0000000002236000-memory.dmp

Download

memory/2828-130-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2828-121-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2828-320-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2828-127-0x00000000004D0000-0x0000000000530000-memory.dmp

Download

memory/2936-66-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2936-64-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2936-53-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/2936-59-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/2936-60-0x0000000001A80000-0x0000000001AE0000-memory.dmp

Download

memory/3068-337-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/3068-140-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3068-144-0x0000000140000000-0x000000014019D000-memory.dmp

Download

memory/3068-134-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/3212-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3212-67-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3256-79-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3256-155-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/3256-73-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3256-83-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/3304-150-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3304-152-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3508-358-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3508-171-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3508-115-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3720-159-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3720-364-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3820-99-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/3820-104-0x00000000007F0000-0x0000000000856000-memory.dmp

Download

memory/3820-109-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/3820-163-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/3824-156-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3824-363-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/3972-253-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/3972-119-0x0000000140000000-0x0000000140131000-memory.dmp

Download

memory/4208-949-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-987-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-957-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-956-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-955-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-965-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-966-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-967-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-980-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-979-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-978-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-977-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-976-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-975-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-974-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-973-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-972-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-971-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-970-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-969-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-968-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-981-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-982-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-983-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-985-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-958-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-986-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-984-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-959-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-960-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-961-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-962-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-963-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-964-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-952-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-954-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-953-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-951-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4208-950-0x0000026E40320000-0x0000026E40330000-memory.dmp

Download

memory/4372-31-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4372-129-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-39-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4372-37-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4392-365-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4392-164-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4568-167-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/4568-112-0x0000000140000000-0x0000000140130000-memory.dmp

Download

memory/5072-147-0x0000000140000000-0x000000014017D000-memory.dmp

Download

memory/5072-357-0x0000000140000000-0x000000014017D000-memory.dmp

Download