d69bf02d5e99b14ee649da40cb3891b494051e421a854980b778acfd1770f37b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260422-k2rnraf12y
SHA256 d69bf02d5e99b14ee649da40cb3891b494051e421a854980b778acfd1770f37b
MD5 a4f72a0f80bcfa71fbfc5e05ecc1d221
SHA1 8427bc8e7d4d32c944dc4ad0b2b4001f81a85993
SHA512 1a5d8af61181a010a97f80a4474ad7387849333bcb0f5083c949b356aad1bab27ce15b3a26d685a2ea7bab6083f554ac0b68dd5a69ab0b5be47b5f553596666e
SSDEEP 12288:laKEFVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:nq1nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C45502252500D466F71A0BB05842F5D04A6E4DBD6AD4F24FF67C7E3A9A362C30AB724F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2644	alg.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
4248	fxssvc.exe
3952	elevation_service.exe
1128	elevation_service.exe
3376	maintenanceservice.exe
4040	msdtc.exe
2000	OSE.EXE
1520	PerceptionSimulationService.exe
1076	perfhost.exe
868	locator.exe
3304	SensorDataService.exe
1644	snmptrap.exe
4712	spectrum.exe
2032	ssh-agent.exe
592	TieringEngineService.exe
896	AgentService.exe
4968	vds.exe
3128	vssvc.exe
816	wbengine.exe
2500	WmiApSrv.exe
3676	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 34 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6e82ecd914bf40d2.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_878525368\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_989069398\nav_config.json	msedge.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_158097531\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_878525368\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_989069398\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3660	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d09608137d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213223784282129"	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4f0ef8037d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000089bb518137d2dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e830678137d2dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e71d008137d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033c8e08137d2dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{75D5F591-43B8-4B3B-8FB9-42881A75F04E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1656	DiagnosticsHub.StandardCollector.Service.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
1656	DiagnosticsHub.StandardCollector.Service.exe
3952	elevation_service.exe
3952	elevation_service.exe
3952	elevation_service.exe
3952	elevation_service.exe
3952	elevation_service.exe
3952	elevation_service.exe
3952	elevation_service.exe
5328	msedge.exe
5328	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4268	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	4248	fxssvc.exe
Token: SeDebugPrivilege	1656	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3952	elevation_service.exe
Token: SeRestorePrivilege	592	TieringEngineService.exe
Token: SeManageVolumePrivilege	592	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	896	AgentService.exe
Token: SeBackupPrivilege	3128	vssvc.exe
Token: SeRestorePrivilege	3128	vssvc.exe
Token: SeAuditPrivilege	3128	vssvc.exe
Token: SeBackupPrivilege	816	wbengine.exe
Token: SeRestorePrivilege	816	wbengine.exe
Token: SeSecurityPrivilege	816	wbengine.exe
Token: 33	3676	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3676	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3676	SearchIndexer.exe
Token: SeDebugPrivilege	3952	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 1724	4268	2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe	88
PID 1724 wrote to memory of 1772	1724	msedge.exe	89
PID 1724 wrote to memory of 572	1724	msedge.exe	92
PID 1724 wrote to memory of 3660	1724	msedge.exe	91
PID 1724 wrote to memory of 572	1724	msedge.exe	92
PID 1724 wrote to memory of 572	1724	msedge.exe	92
PID 1724 wrote to memory of 3520	1724	msedge.exe	93
PID 1724 wrote to memory of 3520	1724	msedge.exe	93
PID 1724 wrote to memory of 4428	1724	msedge.exe	95
PID 1724 wrote to memory of 4832	1724	msedge.exe	94
PID 1724 wrote to memory of 4428	1724	msedge.exe	95
PID 1724 wrote to memory of 4428	1724	msedge.exe	95
PID 1724 wrote to memory of 4832	1724	msedge.exe	94
PID 1724 wrote to memory of 4832	1724	msedge.exe	94
PID 1724 wrote to memory of 3068	1724	msedge.exe	97
PID 1724 wrote to memory of 4912	1724	msedge.exe	98
PID 1724 wrote to memory of 3068	1724	msedge.exe	97
PID 1724 wrote to memory of 3068	1724	msedge.exe	97
PID 1724 wrote to memory of 1672	1724	msedge.exe	99
PID 1724 wrote to memory of 1668	1724	msedge.exe	100
PID 1724 wrote to memory of 4912	1724	msedge.exe	98
PID 1724 wrote to memory of 4912	1724	msedge.exe	98
PID 1724 wrote to memory of 1672	1724	msedge.exe	99
PID 1724 wrote to memory of 1672	1724	msedge.exe	99
PID 1724 wrote to memory of 1668	1724	msedge.exe	100
PID 1724 wrote to memory of 1668	1724	msedge.exe	100
PID 1724 wrote to memory of 4660	1724	msedge.exe	101
PID 1724 wrote to memory of 4660	1724	msedge.exe	101
PID 1724 wrote to memory of 1608	1724	msedge.exe	102
PID 1724 wrote to memory of 1608	1724	msedge.exe	102
PID 1724 wrote to memory of 1028	1724	msedge.exe	104
PID 1724 wrote to memory of 4988	1724	msedge.exe	105
PID 1724 wrote to memory of 1028	1724	msedge.exe	104
PID 1724 wrote to memory of 4988	1724	msedge.exe	105
PID 1724 wrote to memory of 5024	1724	msedge.exe	106
PID 1724 wrote to memory of 1464	1724	msedge.exe	108
PID 5024 wrote to memory of 1016	5024	msedge.exe	109
PID 1724 wrote to memory of 3300	1724	msedge.exe	110
PID 1724 wrote to memory of 3300	1724	msedge.exe	110
PID 1724 wrote to memory of 4388	1724	msedge.exe	111
PID 1724 wrote to memory of 4388	1724	msedge.exe	111
PID 1724 wrote to memory of 592	1724	msedge.exe	112
PID 1724 wrote to memory of 1996	1724	msedge.exe	113
PID 1724 wrote to memory of 592	1724	msedge.exe	112
PID 1724 wrote to memory of 1996	1724	msedge.exe	113
PID 1724 wrote to memory of 2328	1724	msedge.exe	114
PID 1724 wrote to memory of 2328	1724	msedge.exe	114
PID 1724 wrote to memory of 3548	1724	msedge.exe	115
PID 1724 wrote to memory of 3548	1724	msedge.exe	115
PID 1724 wrote to memory of 3548	1724	msedge.exe	115
PID 1724 wrote to memory of 1848	1724	msedge.exe	116
PID 1724 wrote to memory of 1848	1724	msedge.exe	116
PID 1724 wrote to memory of 1848	1724	msedge.exe	116
PID 1724 wrote to memory of 592	1724	msedge.exe	117
PID 1724 wrote to memory of 4888	1724	msedge.exe	118
PID 1724 wrote to memory of 2004	1724	msedge.exe	119
PID 1724 wrote to memory of 3332	1724	msedge.exe	120
PID 1724 wrote to memory of 3332	1724	msedge.exe	120
PID 1724 wrote to memory of 3332	1724	msedge.exe	120
PID 1724 wrote to memory of 1548	1724	msedge.exe	121
PID 1724 wrote to memory of 1548	1724	msedge.exe	121
PID 1724 wrote to memory of 2572	1724	msedge.exe	124
PID 1724 wrote to memory of 2572	1724	msedge.exe	124
PID 3676 wrote to memory of 5368	3676	SearchIndexer.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_a4f72a0f80bcfa71fbfc5e05ecc1d221_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://192.168.0.1/login.asp
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffebd04c188,0x7ffebd04c194,0x7ffebd04c1a0
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,16822950154155942861,3850778388101999901,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1492,i,10639310815444548277,15324634332349497243,262144 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2108,i,394819399827335665,556665122248536829,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:13
    3⤵
    PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,5667877000979642158,3744435576685552948,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3818771093597939480,6405678256033590099,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,17715718107657573421,9057589682959967826,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,4178859122683915792,4779768895457018837,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,9505526288875932489,1307644103227625665,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4236,i,1743590023849977744,10881634704136469087,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,12458366544840387770,1326741906448228779,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11541339450959985803,12919223349370897775,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,4955128055143909385,13234705384266476226,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
    3⤵
    PID:1028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,13726370595188612877,1812972702517411649,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
    3⤵
    PID:4988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2066375836603114505,18296338269004255757,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1128
      4⤵
      PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,12833036043468951034,4629969401937732783,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,12833036043468951034,4629969401937732783,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4906487358987171526,8431365117257055682,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7159891483835956842,153796809863390133,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,9351959372934609539,7199591453623412175,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,4473655501547416600,9319737075545070495,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,13258728464785488125,13079181718420651452,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4156,i,5441515358339671407,8469452085172268414,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3588,i,13480880609162210193,15686874217107180993,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7129554819503419004,9978001228058059538,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
    3⤵
    PID:592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,5168210150354540408,10493441049357110356,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3551158453186772809,6140782735832943950,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
    3⤵
    PID:2004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4156,i,17616287928728954728,3144501822190133288,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:1
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,11703067404891721720,14163863577651019200,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
    3⤵
    PID:1548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,4940761512404651288,2619035056118539100,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=2992,i,14554282666503804991,12165613628673171529,2097152 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
    3⤵
    PID:6096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,1676499939606803256,14116333968231821897,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
    3⤵
    PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,2646340992663881307,4395325501125293443,262144 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14091234169362231351,12712189401281771361,524288 --field-trial-handle=2148,i,913574909923915247,10446486528820520682,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
    3⤵
    PID:5652

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:2644

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1328

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3376

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2000

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1520

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:868

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3304

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4712

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1016

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5368
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2840 2880 924 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5528
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 940 2908 2920 924 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f62ce00a0412bd08df6a652b474df7f365f90b3d6c01e5773d68d87242079856
MD5 9760a18af253e8ac0d710da485426478
SHA1 806ebb7b3b84f2eb028905b694f05cde1c609ece
SHA512 32ede154765e392bbf6144477807ce4a2fee6997a8f77bc9b07a8e03a97fd10b75b3af24cabc1dad60b9f0afa89cb49e52d103a7fe47ea2a41afa1c3288d3599
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnkQ/lFTjN4:T3q6HjBcLm
TLSH
T144D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7d7456b6f1141dcf28909779bc9452ca82bdbeb9b2c7461247e3d52241809600
MD5 8426c7634eac909034d4c3ae189e0407
SHA1 bcd1e7397fd865acbc680a8d09934f8f5e4f217b
SHA512 b24d686fa30c9f13c1a9e69432f7dccb4e93dcf4cbdc6a53df200edc2338328e2ffe0cf667171d7406e255d5a87b17b20dcde7089044ddb6dfa833ebcd9ed56c
SSDEEP 12288:c1XLsswWkxy2lRq2czATGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:qXYfDtczADnQ/tbw/2Mkjy6Fr7g0o
TLSH
T10C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1ceb8b5dcd99de31c4088443a7fce3fc4bbe55a771d3077ee666823de8ec314d
MD5 726ed333abf9d833747b1bd7ec748558
SHA1 9c2305196672436e7b459f89a7c824053d9db357
SHA512 d1097c4045448a2d4db1d50a4bf78b74676886e4883e33f50648ecf9160109a0f14e761762db2c1426b9391b25bba34cb76a93cd374e12790f66c426e22516d0
SSDEEP 24576:L0Le5ji0hmxLrMwnQ/tbw/2Mkjy6Fr7g0o:LPji0AllQ/lFTjN4
TLSH
T19D859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ed6b438c6ea359880f1c7ba5cf8c56fd2b473af7d3f3549a1c984c224d37c733
MD5 88c0c99c208b11c4eac35fd8bc0a4e88
SHA1 ddd088c9db1b5d86d9df1933e8b8e6c5ef707bac
SHA512 df97db58f919e087dad837855e725cba79a0e25ab575f363fd2efde8adaf8e46fc68e7ee8de914f5086ed96c20b81d9c78f5588ca8438f5a0d6be6c880a4ebe5
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyuenQ/tbw/2Mkjy6Fr7g0o:y/ezSC6vUzPvxHjy5Q/lFTjN4
TLSH
T176755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 458587af52154ca0d9d12cba4aecb1ff30fcd9db5d9f3e557244b738dbb8d690
MD5 abb5374312111f34dc0cabf93e60a986
SHA1 19a92e83a93b03d0bc26f3d9d7213528e86f5262
SHA512 96e165dbb3d9801b3efea593bc16243f0fe69e3546f11b663908d91c9aad18bcdc8298ade9421b7d59d7e11c56787324c295a45393c6812d61ff84a155d7c4ac
SSDEEP 24576:mVbqPb88hv/l+6HnQ/tbw/2Mkjy6Fr7g0o:mVO88hXl+EQ/lFTjN4
TLSH
T125559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 89a90711de1361ad69b34701e6cb75a3db4414c8c3e45b70df3e125659193625
MD5 9ee40e2d8b4c1c5110f8b7bab301b4f9
SHA1 b532fc83a2906940d36f119d3b4698f885480be6
SHA512 98eb608cf752080a89d5b11cbea5abe7da35edf8729eca862cb25ced7c9b2fa51fa594843dcef6dd2785e5f449c7542406705a9ffeb01acf43ebefce3b277158
SSDEEP 12288:+zMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+zMnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1635523696668F897FF2B0AB15CC38482AB7B0DC1AFD4E74E6744322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 edceba8496b038eb669d12e77b6ff7301b0ec4346131325ef2b5766baa8a5fd8
MD5 f30dc5ad893bf7149321b738cd402ee3
SHA1 fb23a8e2708153c321e8347adde3a65fb63dd9e1
SHA512 ca8abf7145a9ff879cffdccd4ac9d26e1b1f82d4b33909337166f62a8eb7521f6e79101f44297decdf6b3c7bcc276594296efe01c3341c850a046f6f4afaa491
SSDEEP 12288:eeBNUbTVO86UfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:eJIU/nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1AC75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e3dc201cf022123609762084839f3507256357e0eee7674ae5c26d10fb508e0f
MD5 e6f624276ed3f2fdbf3fac36a469cfe7
SHA1 9a0a33729e9d028cfa339777ba5c0aab586ad9c8
SHA512 8d7686bb741a0a04e826cbb9fb46f87a3ec9f23e64d32b67b87bb9586b46760ca4074e1989965b2eda43db486717f76ee45f1b797a523f6b00100a287480a436
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:1QvGAdlCEL8c/yRNw5CJLm
TLSH
T172267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c85307376ccb16f25f4ab7db33e92b56e0d7ab6a97c2ca54bc619afb4b09afb4
MD5 920554e57a848130d5e3cba337baabdd
SHA1 4a45c9a22c35954262fbe3871ef488f502fd4677
SHA512 d3559a1f35ab20dca214e3159f07d64f4e87c20c4de8a69a988e16c1496db551aa8e291730f080c2d8e3b9e4b97ed83ba7950e1cdcaddd62d129833e8cd94fb7
SSDEEP 12288:oAwSfxL/2Dc39DLLmt0LDQewsAjVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:NQewsAj1nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1FB75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ea1ee7dcfd745d351e07c8543582d401cb67a4f5c044d62561af3b1e47d3469c
MD5 9ac6118f93f06a6879805d0aad05d845
SHA1 5f8d515741aaaec4045fe48f9908eb32c5332d79
SHA512 c4293ab2d6be9b4e4a6284e4f039cb4a4b743514c962cf32df90814ce17f3f886bb940895aacf4b8baf9346f63ac152f1d3611635e29b7493a412bd44877a9d1
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSL:oUEtQevvqc2W1cpV2EI32
TLSH
T122474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0a78de8c79d33f22b88c940a67525018f87fba24e01e3fb9ee4ee3c874f521a
MD5 0ccfae55604fc8daf3e29b9cd236b831
SHA1 ba3b12a7e45483a3f9bd42df945373815eb654c3
SHA512 b139d81701c6d52e54c4613c19837e454e5d1329ff9a07557c1a2db4f5247341b1ca1630a881ed2f1090f093df965ca2af00e9c0995fb75e38e50b4bcae68c40
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zVQ/lFTjN4:yoqtVjnmdLm
TLSH
T18BD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9f791fccbe3b4cab1d45568606ba9339e4ae552ed8ad31bd4ef7712c43d39411
MD5 54bd797f7f7bdadbf566dfd884e32a49
SHA1 1acde24afa735a598ca354bf2d813af852c2385d
SHA512 64d9e60f7696e586953b8115193597a072d785d1bb36f21e384a6199419a47d76c2db0fe2c174b87f1ea7c21dcf34e38c90ec5568042ed58a1574cf55bbce66b
SSDEEP 12288:Hmw5HEjsChN2BFgl0WDm+C+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:GwuHOWZnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1F565F14976A41CFAEA6742398993C136F7B3BC422A61DB1F1760C25B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7768438bd8d33336863d5aedc966798e76a54471c2a9450445a7d09891888117
MD5 5fce5beb0cc8c20c5b957ad84033ff5a
SHA1 526e0189926ce013e4ff8d268923c12f4ed69c9b
SHA512 f203cf93762e2ea5e73c79ff2b85d89960d27e193423eebc45cfc4c93f9bd04a7c3668d3b3875eebafe5ae26d0bd8948f58c874ea19137a539b4a6102b8ee770
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTQ/lFTjN4:gu6JmVxd2d4Lm
TLSH
T17AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 02f9fb4fc6b41b856f106f3116a92d70ba10e93d9372afbc84051f21787b4422
MD5 6af5642e1f6b2902466658f296f29a80
SHA1 38ba513a10179ae025648bccbb4285e7f249482b
SHA512 1a95d410db35a13700050295459fad6675dc5a937b28e2c429e2a79df07fa28521b2780beeb7c9b7a9496991f1d9d9fd5ac1c6fca6cc25319c98e911a10df6a5
TLSH
T1FC615ECC51AD8518EFEE45B006DD2C7932B0465669FB0E9313F991BE7BEFB1181D9840
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5db73115476294d3d472030beb647abadc2ea0e74b9e8be8749b68765979b32b
MD5 47a068705476639b00527de1d9fbf83b
SHA1 e9b2835d529610b881a88322945514dc47bbac46
SHA512 f600278e6640d5aa36bce6bdfa5a621f96b332bc28f4f7947c054f61b89e6d795247cedcd0797c78b0b87ad153f23eeb1102f4920a49799dcc564679b7bb5daa
TLSH
T19341BCF7C3E8866D891196F0AB187E2BCE1D0A64432C3D5AC9E4EF1B93E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 65546097c514bbc21d863300ab1e05bfeaa73be54ed96edc8203a93b233360e4
MD5 0dcff3a0fc0be9387826628631515dd2
SHA1 213f1058be15a73f7014e87204b8d59ba3942b80
SHA512 954d7ef7cd51df24d73fad83318adfaa210bec406aed66df2fd6f036e1b3147ec704716a729c69dcc4bb1be2c9cc629a29eda4912e1a833ff083913565e5fe8f
SSDEEP 192:sxZCRnyM//K1Ml8Mcl/fPsQUZBUxM+IdpM/W6+WNGY0xkjhp7YIg4J:sxZCb0l/fPsjZOevM/bG5pc
TLSH
T1F552E805AA385937CCDBD209BA55BF53D6F51463A2900E44ADFCCA0C04E6BED6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ef1b43b5d9712ef8a64bc0ea5d29f517a9302a5f2d1b5558cf2e36571ac1c4c7
MD5 4d8db20b2f78af122cde9f03d049eed2
SHA1 1cfea3b75da45f42e8b755b75e1389b7cef82aaa
SHA512 64d7fc107feaa9ddd42c4c391164fa3e685012b0696bf380d1d46c46af81d494252804f164c83f4d4baa9dea3dcd37026ce3f19e00c808e5a7ba4cf32d3b04d3
SSDEEP 192:sxZCRnyM//K1Ml8UQ+cl/fPsAU0BUxMhIdpDi/W6+WNGY0xk1LB7YIg5qJ:sxZCbq9l/fPsz0OeKe/bG5TQ
TLSH
T11162F906AA385937DCDBD209BA51BF53D6F5146392900E44ADFCCA0C05E6BED6217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 283fc0d9282c9d142a10f6459ea6cee66b8d59c87071dba61f4f8ef368cac3d6
MD5 cf1982167faa6afc3c6a76cc69863f7b
SHA1 915d47d50dd96186b8950ce043241cb796a63e9c
SHA512 d0701e050b4cf3f19da994247ccc4f214ef48537f90ab743aecf853f90b23ae8544c8ca42bbc0656752439b850e1ff19a1d8ee432a4892b75bccff2ad53ea2f9
SSDEEP 768:nPK2G8g+22u7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Zcc8LlN:nPK2G8g+22uEndJWRmdnQaPu1jaKZcci
TLSH
T133031C3B280CCB7E4F844E9CEC26BE9A6DE8018B9698CD9447F9844C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 63d22f90a6f16f3f2e67116f111ccbeee9be046c6136d4331a2094e6ec00d6ac
MD5 64009afc61ea366cc93c948f01465fa5
SHA1 a4caa08569dadbd6d3229bd7011a92d44fefba25
SHA512 cece3e757fc868ff1f9ea418505413af5fcb48010f7ce0a9accb2e851b576a6e1c826ffeeb06c77b2347d5d90f78a482346b3f401f8cb528a862369548efeef7
SSDEEP 96:KAhyKisSKacKvqWejKKsMY2ty2QYYuGIn1wWuKobwcuk+W/Mmv+D6Kgog:olfjh92ty2QYYbInmW2bwc3+W/Mmv11
TLSH
T1BFE12790B07F16412A7E695E81E0F87F02C231673418A57B3BB811664FA6E11DDFEEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591227.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591227.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 1f4b9fae09df3cc21d1075faa658f9712e5a20b7dfb0346c785658fe9a0048a6
MD5 ffb4c8cc6d492fe6fac9cbfa7334eb85
SHA1 40dce1407cf316a8e4c61643b8cf461cbb4170a8
SHA512 84b16ae185a60f15ce98e14db847d4cfdd7d0c5aaeb78b410e33d223563ae52a528c621f82ffae22f4229f624ea214bcccb94176f3af6decf9f251b682cce309
SSDEEP 384:nfiF8jccCs+Bt0S3+8N98TUNTUlIlH0eNyzVDfw4vAwkPxalZaFCSBFY+Of3U:qF6ccQeUwgMW4Pk0luCSt2U
TLSH
T1CFB22976E8A4DD3BADF39B85B64676479FF001A389C86ED4D9D85E0C00CB2DD070AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a3fc0a145b4f4dcc80fca8f2c1f11b1675e0b5d6b9662014fe962f8155d0f185
MD5 307d46e161f1153a4d8f3ba6de1c0a2b
SHA1 c9524ffbea7559040c52a69e39e345b622c72bf6
SHA512 4848235535bc4c9c9505587ae7fb4f4ab3cac19d783d68ddf4a283c4d6530c9d4e4271a7fb4409f8444b10128fc3a81805213e09d69ab0ffc78a3d8ae13a5480
SSDEEP 384:n/jccCs+Bt0S3T8NjH0eNyzQvAwkPxalZGCSBFY+Of3U:LccQznMPk0lkCSt2U
TLSH
T1DB826C716CB85C3699E3B819B1863B575FB41077AA842F55D9EC9F0C00DF39C170AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 07590a3a28dcc69311eb361a91d0fc5083e5cf81d151be08a3da46176b9bc142
MD5 f2725e47513ae5bb0904ac4c2f745f0e
SHA1 084deedbdb550cfd43c91bca31cc65ec49197bf3
SHA512 27a9c40d8e8a5f797ec3132c17417609fd7766121437cf98bc1fa15c0fb1070d08f6417aa17a8073062a3457d29c19cd6319694abdd8ed4d52c4ff559cebec1f
SSDEEP 384:n0jccCs+Bt0S3T8NjM0eNyzQvAwkPxalZGCSBFY+Of3U:CccQz0MPk0lkCSt2U
TLSH
T15B826D716CB85C3699E3A419B19A3B575FB41077EAC42F55D9EC9F0C00DF39C130AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 503edc67af58eb1b89ffc37a12e34a5229e727cb385ce8cd00606b26a44b334e
MD5 c4444ceff1b1621cbcfa18bcb81f30da
SHA1 c637969e55e9a8645df583d94683867c64a80f23
SHA512 ddad512909fb577b4753a516c481023f97e0e1f6eba7324f715748818cf7f66941cab606118be60bfdd6e69fde123588eca8eff18beaf0c518ca55d91db1360c
SSDEEP 384:nhjccCs+Bt0S3T8NjA0eNyzQvAwkPxalZGCSBFY+Of3U:xccQzwMPk0lkCSt2U
TLSH
T11A826D716CB85C3699E3B519B1862B575FB41077EA842F55D9EC9F0C00DF39C130AA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 25e7d0279938e1aa0dc7feca6226d640b439e5a718ae43c35c19f77e7b5b6c09
MD5 6a21ef20636e4ea0a0be7ca2b5db288b
SHA1 ff125d8f6434899f9af5f002d1fa7567e98356a8
SHA512 2556c4966ced2272d9873d530f5eefe0a03dde9ab0bbb73a9bfefea4aaa8c72dee5adc3520cbc29215e7bde93abff9fff01d96dd6c5a61a443ba50350c67be00
SSDEEP 192:bGNu6EajKQmiUygbhRvAwkx9xRwlZyzupSrqibU6:bGNu6EtxhRvAwkPxalZ/CU6
TLSH
T11012F875B87CBC6A5EE3B805B4833A176EA52137ED846F54D9E85B0C00EF35C270E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c613f161119fa40f2d5c445579ae6b8c938c29e9e872777213bcb7cb385a217d
MD5 45878f2accf3504f0298c27dde3e8735
SHA1 a5f925f75236d94386ebea6442b6599f5afccfba
SHA512 6ae0e11355e957473eb9f07799b2e40239740d0a08033b3917ba9c5e4804b62b1a5bb0215e52b3562720429a9de9f41346b557ed755e34060c2249404fad76af
SSDEEP 192:VGNX6EajeQmiUyTw/bnRvAwkx9xRVq6QTU6:VGNX6ENUwDnRvAwkPxvyU6
TLSH
T10102E735A87C7CBB8EB3AD05B0427B176FE5112BE9952F84D9E81B1D40EB35C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

be44a766-40e7-4ba8-b974-7505ebbb403d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be44a766-40e7-4ba8-b974-7505ebbb403d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2ebc1f62-73fa-472d-8bf4-bc8588a38dd2.tmp

Path C:\Users\Admin\AppData\Local\Temp\2ebc1f62-73fa-472d-8bf4-bc8588a38dd2.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3e076ee-0b33-4bc6-9428-c33a504c5556.tmp

Path C:\Users\Admin\AppData\Local\Temp\e3e076ee-0b33-4bc6-9428-c33a504c5556.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1724_1121370220\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b72cad0e-bb9c-4555-bc31-9e09422b2a3c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1724_679000840\b72cad0e-bb9c-4555-bc31-9e09422b2a3c.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0d8f6afcdbcc323cd542446be79ce7a0f0b0c599840eaf6bf787ec16461c7e44
MD5 0c3ff8f63c0ad9df8fad0fd9e0300903
SHA1 cbe31247385e64e6ca1faf16db6bf5e5123d56aa
SHA512 6bec69f8601622d80098cc850fdb9d516af8de338f8bf46d678820a50e501623f124a6798f5b25862c6c25af73b56abf2f5e39d06312b87f08d64199e9f8070f
SSDEEP 12288:4pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:45nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1035523696668F94BFA3B06B04893C111673F0DC5AF90D3CFBB042269953C3C01EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 357dd7812190ff954e2816da15c66512173196d526f627fc1f8b2d6c1bc36cf7
MD5 6d8fa5f4f25f8c2eb93945c69522c737
SHA1 34e9350166db115a2eb44417ca757efea2380d98
SHA512 2911ceaf57d1a015fad11b6da6d5ad15c091fb5de2a9c1ee2a63ca24bf7ed95d612b25af90bcd6145c31463cfc89f199e4ecd2e7c48df79cb2af664d77962c6c
SSDEEP 24576:K8RMyNoSFw1d+rC4vrmRcGPiQEaaPnMRTCPnQ/tbw/2Mkjy6Fr7g0o:7RZwQCyiHiQEaaPnMaQ/lFTjN4
TLSH
T19785B01E62DC46A5E0BAD2B8CDA74407E6B23816573197CF1290C27D1F37EE45E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 b431b1e712eebc29aadaabd24b3eca1e85b46ead2613bae24835c69c6b7df217
MD5 66d6dda98eba2c13fa64841d424f2dcb
SHA1 3d2830a3946303d4e578c3ab9216cab25aa98e51
SHA512 0dc8eaf75c8df0483241e6cf2dbff99e9decf29294d7afb710a251e55d675f36f39df34cbb7f6ded0b63b29741136b91faaa2241f87bec4a741c9a933db27c5c
SSDEEP 12288:obxA1U7KnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:obxA1UGHnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18355123E66AC24E6F536967D88C28106D3327C56676193DF2284823E4F3BBE41D76F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 2b847e5c3c0c54ca1a1a2afcc05c503e25321c16ee13f256a557427a08cbca22
MD5 de9daa5dc428b5226014703cdd70b598
SHA1 df59c6bf220417f1b7da673cdcb2af3707685299
SHA512 f2a526ed2401a301d42ca74962dd6732691f9c772dc0c34b4dfd04fa35a8438403454edf245c77827117ee4dc554e46abe4c0d89535bb5b4ce9cd0ec908807e1
SSDEEP 24576:GjsmP0yHaqrVqHra44KDzMsrnOnQ/tbw/2Mkjy6Fr7g0o:GjRP0yHfVqzlAsrnOQ/lFTjN4
TLSH
T12B45AF2EF2B910B9D8AAD176454107B5BB71782D1F209BCB0170C234AF1AEE85F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 0c0aff1d38e34194e8faeca8b9aa5bde6d41c632efdf85655e185e67b8524d62
MD5 b3b323daf3959e2fe077855b785c30c5
SHA1 e36c328f9c9569d06b4552e6cc0ecda1534f8f63
SHA512 c92275efb0f2f75b4821b1986f46469c8ce9df4b1917d5f8d3b2c868fe97a7364b95ce632310850a736ce371abde4e447eccc60ea34e3a48f0e0578d1d128549
SSDEEP 12288:j3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:jXnQ/tbw/2Mkjy6Fr7g0o
TLSH
T17455236C7659F98BFA2B06F548828142677A0EC17FD1A3CF7B442229967D3D40AF7780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 78e453177dde630165bf3a0ec02719e20512fbff9e1f6fa3bde53c5e1a66de70
MD5 2fe1900b34f101fb8c9f3703ab41faf9
SHA1 77a4cf6cb6568a513448e97be5a9912cbd80ac55
SHA512 b9a7b59576d9750ecdf1cb8b88e34105e774b177166b39ab829c002c20eb41f18b756171827d688d206677f1a8f0dca3a442b814931aaaba3f367b5217186729
SSDEEP 12288:gOb4A4LWO+vAYFT9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:dwLBUTdnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D275F155F7A450F9E92B823CC8A28616E772789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bdac149af56cb68b2d600fb19089706966e80d0b77e79b36f2335bc45bbc5434
MD5 3575f6b02f7b3d101b376d54727a329c
SHA1 af09057357ed4c1d48ac57db9a5b3e621e27d884
SHA512 6087dd16fe3d1805fff6dd63406b8a50e4b56fdfbfd6b930edb85feb74c2ae9cfaf8b10b582b0553d9195b883df98ce87ef2496bf7c59f989119979e320b1823
SSDEEP 12288:a70VmuIYNvUyBpuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:rKYNHwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11A65F12E62AD1CE5E53B91798AC38209F2737896175193CF05A0827E1F37BE87D3A741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5fcba054e5bd20db414022283bf8de1f654f37b8b39f229df48370359b2abbde
MD5 0283d55cd5223b23731203d13960c66c
SHA1 b565887d3b1220c1cc4182cd9957c8abd9fa383a
SHA512 6fa563069d8fda6add9f3afb6ac3b164f24c08f8a122a69e4dbfbb617552ade1e3cc2f83830b32f2d0e353e5346564c378086b58d4f537ad6dab095c0e2304ac
SSDEEP 24576:1nXoJjNYH84VVSNAApoEON66aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKT:1nXoJJYH84VVS6AmEcJas+cHBjSSKHPj
TLSH
T11E65BFADA2BC04E9D5BBD17DC5C24506F5B278621331C6CF026082BA7F27AF55E39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 985428b8cf5568d0f7cd81d7878fa279f303a465a87be509883e2558b16af590
MD5 5ceb627de08c511a961ee167bde18deb
SHA1 f22b02d4edbd75e20a658089a928fe1d1a92d76b
SHA512 b72f231ab528b2bfc661d6f90c623d31cac4c1308ab8e3695f63737f1b643323a6bc92f2821265aedfd7d17a7c3f366f01e3155092ae8ad64468c1f503e04ab1
SSDEEP 24576:kv7Xbxd9Tuycf8M/TYlSuxwr2PC2nQ/tbw/2Mkjy6Fr7g0o:kDLL9TuJ0M/TYW2P3Q/lFTjN4
TLSH
T1E8858D5EA3EC52D8E47BD6BD85A39046FAB2B895273081CF1250856E1F23BF05D3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 e268ac3b04e9f82f17399172bf083f966e5c37d2fba52b2dced4fcd753bec264
MD5 2156091ae21567fb293e93169137d9be
SHA1 6c4eac79c319215ffcca17d40c0f6cea34934327
SHA512 5a1dc3f2225e4ee157df2b62198ddae5e12358147135155a76b0bbafbdf6f2bad6f7d8751abaa3b58de5086948db05c92733176ea36858ea20dee9c9e53ad3f2
SSDEEP 24576:vegJgpwJOmPOHWAK+8ZguIGyPsxr5Vin10wdnQ/tbw/2Mkjy6Fr7g0o:vngOJOmPOHhdQ/lFTjN4
TLSH
T12F55BF3FB7BC15D5E03EC17D8A928916F6B1786613255ACF0550827E5F2BEE42E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.6MB
SHA256 14af9873ab5dd295c4ba6bd8d45f719fa5cf93646941c6b09f37036b1c585293
MD5 b0e6a3427b7656518739a50365a9b319
SHA1 227896de94d1f7016f9192a9722743c905a837e3
SHA512 53692257a07ccd9efa6aae36fb5e7256be9d42ae9b21c434ae86ef1c2d8c1349f265da2778f36a8d6d748be60ddbe7bc2579c939f7612f75f08aa2e0fb5e63ca
SSDEEP 24576:6LJnJiTk3R3waE4JrO3nQ/tbw/2Mkjy6Fr7g0o:6LJnJK8R304lMQ/lFTjN4
TLSH
T18175D03CD2A810E9E477C2B481561756FF32346D2B216ACB29B4D5353F22FD0AA79F48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 851b560f173d37fb09d1850ced583e90807d1ad19776beb0c80aa9a5992d578e
MD5 6e7e53452ac33d791d8c21c209f384b7
SHA1 ec4de3de9d5e0da2c1251c67b6d1dda463227310
SHA512 ddc30b029cc6d97e3ba151aef942b587e1bb5cbfed7fb626be518f1ee7ef5ca9b4ba5a9c6d87feddc7e43899cd141bf32e7cff162fda4180465e0a865bf250ae
SSDEEP 24576:kA9GqCceDQncA/BmlvLto8cFVr9og9P/Z6pFnQ/tbw/2Mkjy6Fr7g0o:z9GqCzDScAZmlvTcFg8Ph6jQ/lFTjN4
TLSH
T129955C15F7EB5298E8B3CAF1C96294159B327C409B34F7DF0A80CA6A1E32BD1D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 1083b83a1cbf80dfe9456283bd09532777185faf75f914124059aebdd23667ca
MD5 717aa34e75907df822c2b4f3d3bc5b6e
SHA1 b98f9ec407875be25827b8eb4a31c75c17f5e424
SHA512 e543f18258abf44af74cdb94c1a3d1d5eee268602ae45ddbf8c1188803479c649efeddaa9f1c9d4e80b258de4001adfbc22f98e01c15b0d54d4c896760340daf
SSDEEP 24576:alYJeXm5jUuEznQ/tbw/2Mkjy6Fr7g0o:alYJeXmRUuEzQ/lFTjN4
TLSH
T13755126D36AC70E6E22F41B988928545E372B4A1275163EF62D0C17D8F7B7E41E39F80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 a5613b55d224efbfc372b0f5a308c4dfce833ad55e1caf3cb722a2ff1220aef1
MD5 ca00b196cf3428fe064bf23c3b8942b4
SHA1 ceef8300c630a0c196452044be504597d0469dcd
SHA512 cbd3a626cedc3d59d9eb143c5e5f42b7286efce8b22150db1630461c459f70cd7caae6e18c471b5297afa5d1e5c2f89922ca314c3c020f8b37faa50f704e5368
SSDEEP 12288:+Fu6kyuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:+UtyunQ/tbw/2Mkjy6Fr7g0o
TLSH
T11F65121833A4B499FA7A06788DA38191DF3A7C50AF5093DF66C0E33E5E3A3D06975B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 ceffb5dd7a62cd91de72fb7bdb622cf44a4243fa0e56d7fde235a25bbeb60a2d
MD5 b449256cb4fdd2da1a714382b8070571
SHA1 9b74bff38c66d5a3e01bd9e41de8d6d07279e35d
SHA512 329d4fc5a87d73f93a1dc61432267cf5fcb4b877fb50df5a25a64a36d5af8d9ca09b662f142d36203d7b384937fc7f9e23812cc7595d2283262e5999706111c1
SSDEEP 12288:QP9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:QdnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1B055236C2668F49BFE2706F448534142A77B1DD17B91A7EF3684A139CA7D3C01AF6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8eedc57860f6b78a21867724681f07dd63d0e620c3cda1cdddb2b6fdf1ee6a21
MD5 cf84d7d8ac2957610da299d4065f3284
SHA1 ebb632e485095562ebb3ab8802070b4d94d7cbef
SHA512 5096747106d0d5ba261071bc01ba5dbe938599cc3839e75c31a878b22222eba2d8bc68fda6f6d5c09fa7427290a1a5392357ff778b21e74d644f5872332d5cf7
SSDEEP 24576:SC+TyQIu93VAumZr7jmCnQ/tbw/2Mkjy6Fr7g0o:S/TfIq+YCQ/lFTjN4
TLSH
T129558C1DA7E91DCAE276C675C8A34493E633B872137196CF2044C07D49AEEE8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 f9ff046eea81015f2576392a5ed9505e7138f6a3b92c6885e21d3e54a98e526d
MD5 880a39602fdee5fe292ab245a3a040e4
SHA1 6c86b278a3b33948e216f9afeb54898006ade76e
SHA512 2a46f4720dd982911b0619a5e2881129c77d17d8c8e9a5a88f2567567e8a05549696b52eecf61f1884fd08a85dda864d9be5fceb0df43957affd4f8074807410
SSDEEP 12288:lcyrWOstaa3kcsRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:QLQikZhnQ/tbw/2Mkjy6Fr7g0o
TLSH
T15165F11EB3AE10A6E56B827C88824142F7B37471575263DF1290C77D4BBB2E97D38B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 849a04ebae476919ae39cf9550ee65a5e3eeec137465af8313b384a72b0c1533
MD5 695f1c66e4f054a01e4f55613aadab37
SHA1 42af9cf1f21ee3cfc4a8a7eceed14c66ca7de579
SHA512 4144d8888484a6a9992ec98cad5abc6d19021e69b79f231342f312e576101943356c830f69b43410e9dd31360ac5207fe9ce5c46a2eeb62d0e6dff7496075f52
SSDEEP 49152:CpJFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LWAP8Q/lFTjN4:/pC7b4+80GTkQLm
TLSH
T13CA57C3DE2B810ADD9AAC375C5461665EE71382E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_158097531\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_878525368\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1724_989069398\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a9531501456966cc7ec023ae9674c5c8e9d50a9c1be889159e03da6634f15ba5
MD5 252c12ba4c4c4831219646f5f7ffd290
SHA1 529a79b3fe2af500c8f608297c1b17786be65dcb
SHA512 fe1235e39743e65f02fcb42fc31b433e3fd36b1abce2f8e4952593cc342f1f18266420202992bc4dbabdad3508b1fd2eca04ce220844fa57217061ef672b308e
SSDEEP 24576:PSAwJPE1IDAo+4Kt+l44135UQWnQ/tbw/2Mkjy6Fr7g0o:PqPCIo4Kol4/QWQ/lFTjN4
TLSH
T17E55B02AA7F956E5E17AC7B4D663C501FB733822133163CF5290813E0E26AE85E79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-1005-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/592-907-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/816-941-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/868-871-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/868-947-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/896-912-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/896-909-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/1076-862-0x00000000009C0000-0x0000000000A26000-memory.dmp

Download

memory/1076-867-0x00000000009C0000-0x0000000000A26000-memory.dmp

Download

memory/1076-861-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1076-934-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1128-52-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1128-44-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1128-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1128-149-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1128-50-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/1464-746-0x000002215C280000-0x000002215C39E000-memory.dmp

Download

memory/1520-858-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1520-917-0x0000000140000000-0x0000000140175000-memory.dmp

Download

memory/1520-850-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1520-856-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/1644-880-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1644-986-0x0000000140000000-0x0000000140143000-memory.dmp

Download

memory/1656-749-0x0000000000C10000-0x0000000000CB3000-memory.dmp

Download

memory/1656-16-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1656-25-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1656-22-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1656-182-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/1656-706-0x0000000000C10000-0x0000000000CB3000-memory.dmp

Download

memory/2000-87-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2000-95-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2000-93-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2000-708-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2032-901-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2032-900-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2032-894-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2032-996-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/2500-946-0x0000000140000000-0x000000014016D000-memory.dmp

Download

memory/2644-180-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/2644-12-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3128-918-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3128-1007-0x0000000140000000-0x00000001401F6000-memory.dmp

Download

memory/3304-983-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3304-1008-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3304-875-0x0000000140000000-0x00000001401C1000-memory.dmp

Download

memory/3376-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3376-68-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3376-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3376-56-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3376-55-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3676-944-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3676-1011-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3676-1044-0x000000000BE00000-0x000000000BE08000-memory.dmp

Download

memory/3676-949-0x0000000001C30000-0x0000000001C40000-memory.dmp

Download

memory/3676-981-0x000000000A520000-0x000000000A528000-memory.dmp

Download

memory/3676-965-0x0000000001EE0000-0x0000000001EF0000-memory.dmp

Download

memory/3676-926-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3676-932-0x0000000000910000-0x0000000000970000-memory.dmp

Download

memory/3952-41-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3952-39-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3952-33-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3952-703-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4040-71-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4040-707-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/4248-31-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4248-29-0x0000000140000000-0x0000000140136000-memory.dmp

Download

memory/4268-1-0x0000000002250000-0x00000000022B6000-memory.dmp

Download

memory/4268-8-0x0000000002250000-0x00000000022B6000-memory.dmp

Download

memory/4268-76-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/4268-0-0x0000000000400000-0x0000000000552000-memory.dmp

Download

memory/4712-882-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4712-987-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4712-888-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4712-890-0x0000000140000000-0x0000000140149000-memory.dmp

Download

memory/4968-1006-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4968-914-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4968-1010-0x00000000006C0000-0x0000000000763000-memory.dmp

Download

memory/5528-1019-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1042-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1022-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1020-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1026-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1027-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1025-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1024-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1021-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1018-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1029-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1028-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1030-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1031-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1033-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1032-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1043-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1023-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1041-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1040-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1039-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1038-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1037-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1036-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1035-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1034-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1046-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1047-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1017-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1015-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1016-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1014-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1013-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download

memory/5528-1012-0x000001B184D10000-0x000001B184D20000-memory.dmp

Download