d8f81a903ee68d0e6de08b24328e5c4a3fb86cdd2d980d1326810ffd7c65481c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
Size 1.2MB
Sample260629-b79bbaby3k
SHA256 d8f81a903ee68d0e6de08b24328e5c4a3fb86cdd2d980d1326810ffd7c65481c
MD5 e74cf5f8d3931c828d05a2ce67ae2163
SHA1 f0d42ec63d1ab906d92530c81464ad1f1a826f27
SHA512 b08f9a8c4005b665540b0c1ee1deee8300bdf35d54d5050e529260450a3b39d15a16af3a52efbb054e13a4f42749b6d8a2fd0c558d8dc72eac2849a6464153ae
SSDEEP 12288:QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B34523BE924C51DAD92609B5C3D5F15DAC033E6AA920089379977CFEF2F58588B3C423
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4736	elevation_service.exe
1208	elevation_service.exe
3088	maintenanceservice.exe
3680	OSE.EXE
3312	PerceptionSimulationService.exe
1844	perfhost.exe
5892	ReFsDedupSvc.exe
1564	SensorDataService.exe
2428	ssh-agent.exe
3204	AgentService.exe
6056	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
2892	verclsid.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d13df03d585f03fd.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_1267542661\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_1825870874\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_2099470063\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_528201485\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_1267542661\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_1267542661\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_1267542661\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_2099470063\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5048_528201485\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083f5936c6907dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000923c66aa6907dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008502dbaa6907dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002311a3aa6907dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000061ac406b6907dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b0ce9696907dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003729a56b6907dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007690146b6907dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{5C5DE7F2-CF78-4B21-BC9C-82FE41FA1AEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
4736	elevation_service.exe
3680	OSE.EXE
3680	OSE.EXE
3680	OSE.EXE
3680	OSE.EXE
3680	OSE.EXE
3680	OSE.EXE
3680	OSE.EXE
1456	msedge.exe
1456	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2660	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
Token: SeTakeOwnershipPrivilege	4736	elevation_service.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3204	AgentService.exe
Token: 33	6056	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6056	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6056	SearchIndexer.exe
Token: SeDebugPrivilege	4736	elevation_service.exe
Token: SeDebugPrivilege	3680	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5048	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5048	2660	2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe	89
PID 5048 wrote to memory of 1384	5048	msedge.exe	90
PID 5048 wrote to memory of 4640	5048	msedge.exe	92
PID 5048 wrote to memory of 5116	5048	msedge.exe	93
PID 5048 wrote to memory of 4640	5048	msedge.exe	92
PID 5048 wrote to memory of 4640	5048	msedge.exe	92
PID 5048 wrote to memory of 3284	5048	msedge.exe	94
PID 5048 wrote to memory of 3284	5048	msedge.exe	94
PID 5048 wrote to memory of 2552	5048	msedge.exe	95
PID 5048 wrote to memory of 2552	5048	msedge.exe	95
PID 5048 wrote to memory of 2552	5048	msedge.exe	95
PID 5048 wrote to memory of 1220	5048	msedge.exe	96
PID 5048 wrote to memory of 1220	5048	msedge.exe	96
PID 5048 wrote to memory of 1220	5048	msedge.exe	96
PID 5048 wrote to memory of 1956	5048	msedge.exe	97
PID 5048 wrote to memory of 1284	5048	msedge.exe	98
PID 5048 wrote to memory of 1956	5048	msedge.exe	97
PID 5048 wrote to memory of 1956	5048	msedge.exe	97
PID 5048 wrote to memory of 1284	5048	msedge.exe	98
PID 5048 wrote to memory of 1284	5048	msedge.exe	98
PID 5048 wrote to memory of 2684	5048	msedge.exe	101
PID 5048 wrote to memory of 2684	5048	msedge.exe	101
PID 5048 wrote to memory of 3740	5048	msedge.exe	107
PID 5048 wrote to memory of 3740	5048	msedge.exe	107
PID 5048 wrote to memory of 3384	5048	msedge.exe	108
PID 5048 wrote to memory of 3384	5048	msedge.exe	108
PID 6056 wrote to memory of 1224	6056	SearchIndexer.exe	113
PID 5048 wrote to memory of 4812	5048	msedge.exe	115
PID 5048 wrote to memory of 2324	5048	msedge.exe	116
PID 5048 wrote to memory of 2324	5048	msedge.exe	116
PID 6056 wrote to memory of 4100	6056	SearchIndexer.exe	119
PID 5048 wrote to memory of 3144	5048	msedge.exe	120
PID 5048 wrote to memory of 3144	5048	msedge.exe	120
PID 6056 wrote to memory of 3836	6056	SearchIndexer.exe	121
PID 6056 wrote to memory of 3820	6056	SearchIndexer.exe	122
PID 5048 wrote to memory of 4992	5048	msedge.exe	124
PID 5048 wrote to memory of 2132	5048	msedge.exe	125
PID 5048 wrote to memory of 5388	5048	msedge.exe	126
PID 5048 wrote to memory of 5380	5048	msedge.exe	127
PID 5048 wrote to memory of 5380	5048	msedge.exe	127
PID 5048 wrote to memory of 6088	5048	msedge.exe	132
PID 5048 wrote to memory of 6088	5048	msedge.exe	132
PID 5048 wrote to memory of 5336	5048	msedge.exe	133
PID 5048 wrote to memory of 5336	5048	msedge.exe	133
PID 5048 wrote to memory of 4184	5048	msedge.exe	134
PID 5048 wrote to memory of 4184	5048	msedge.exe	134
PID 5048 wrote to memory of 1456	5048	msedge.exe	135
PID 5048 wrote to memory of 3652	5048	msedge.exe	136
PID 5048 wrote to memory of 3652	5048	msedge.exe	136

C:\Users\Admin\AppData\Local\Temp\2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_e74cf5f8d3931c828d05a2ce67ae2163_elex_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" ""
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffcba6cc188,0x7ffcba6cc194,0x7ffcba6cc1a0
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,9721660640332292055,13919385229749589440,262144 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14424487073499865629,3811082673897750603,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,8418600901861827230,8659952513833260745,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,13472906783502008613,4912559003382627742,2097152 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,13261351346351630777,3850420178984703328,2097152 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,12124152132193417660,11428675130295869862,2097152 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,5232474490163786229,4836236391248771736,2097152 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:9
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,17133145486232264068,8802684641915290110,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,16402016378284563897,13933623328016057586,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,9827727873060840299,11422121774250544421,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
    3⤵
    PID:3384
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9366972492081227484,5920939712206996387,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,9366972492081227484,5920939712206996387,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
    3⤵
    PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,6106324461233718333,13121843066330447390,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,1473507889239853495,7136126462457831016,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,13901781146388618591,11638434240500217648,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5443157464393868711,15130063076780325700,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,6136160660577485757,5116714585888822855,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,17809960266325297354,17812929976394777693,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:14
    3⤵
    PID:5380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,10005727395545868678,6722995176039199692,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:6088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,6564151204477221494,15429164499296275915,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:5336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,1472276702287423206,17862205762333231283,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
    3⤵
    PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2064,i,80563778049993713,8553826092524790046,262144 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,7880697279116324168,6311656953577492481,524288 --field-trial-handle=2232,i,12408937484898082166,12180071335830531438,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
    3⤵
    PID:3652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1208

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1844

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3380

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 417c4b1685843ebccb9dfebc4a72f264d470dcd5fa6b75882470d358132f390a
MD5 db1c87cf996403a2c49043cb9b8bd1ed
SHA1 8c1919a862d2b92ac44e84092b53470807f94b36
SHA512 c35afff6aadc8b4af408f3ae21aed6a137db74fba2e525b7d8a833fd205bdf4d1b404ce2b7296e5c8617feee8876fed6b4a7329dbaf116f8c89c0fd65fe9ee8d
SSDEEP 49152:Yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn5Dmg27RnWGj:y3q6sjBqD527BWG
TLSH
T149D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 03f4d71cb1b22b744b39f2d2053b2de45c627da923bd754b5c44966d1d47a847
MD5 64a9102aff47d7013dbafa3c9204d72b
SHA1 b372ab5818d6e40bf2eb9a0d5f179adc771fa6d8
SHA512 68d8ff86b66f2111c1b9b7305013f9d8b4e78ac51295698241a83dff83dc4dafcf98c348b29c07e552d61175597ba4ad4effb7d3c6fe5839c5d4408771f92e45
SSDEEP 24576:JXYfDtczAqsqjnhMgeiCl7G0nehbGZpbD:stcPDmg27RnWGj
TLSH
T1A3650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 749654339d2b2e532c20cacdba41aed8eaec1029987628f07f91fca5dbf6cdd8
MD5 ea5cdbaa472c0fe3ec0ba9e6c9da450c
SHA1 047af6370de395d8778dd41be2c0b5898cdde90e
SHA512 d309198ddb55f0f7076aaedbb6dfa786aa02b8d5dfab2fd03a8c979db5438a9595f5fce04dc8343148cd5f49e626ddc4140bb632266a03f3ff88c6b153e2aa78
SSDEEP 24576:T0Le5ji0hmxxrM9sqjnhMgeiCl7G0nehbGZpbD:TPji0AjADmg27RnWGj
TLSH
T18A859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 60b5d4be55e7456a2f0280600880765f531fd24af204618e22b406388efdb097
MD5 6b135880da1ec80475de6b905ee021fc
SHA1 e4803e7ff90cf665a4cb21bed78f555b59d86609
SHA512 926e249a482ef2d6bf8dda7c44b0fa018c60e1d8320934c1197f96807e5c07609b7dd6efd65646ee26c1cc8ceec4945a1a27d1f117ee20c8f90c455588c90f78
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWn6q8wyursqjnhMgeiCl7G0nehbGZpbD:I/ezSC6vUzPveHjyEDmg27RnWGj
TLSH
T1D2755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8ca1451a07ef2fe6265acd6216192b0384b7496400e4e7d8a500b769ead38ad7
MD5 b7c419d4f1b711d4b985caf5a5394028
SHA1 5c4c6effbcd31789eb56f37f55df4dea654b1e61
SHA512 c37494ba3dd879af85633cab1ecad16bb6cfa035a00baeb56a25beb46ec4686ce559e517cc0ef5d89f43ee9d0686c306647f8476521827917b99ae6b91397106
SSDEEP 24576:qVbqPb88hv/l+Y2sqjnhMgeiCl7G0nehbGZpbD:qVO88hXl+XDmg27RnWGj
TLSH
T152559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e6f6070158e7cb51e58da46578c5703249a0dcb2e7aa6ab9fa234edc6c49a332
MD5 492a51bb045346b46f68ac030753bbd7
SHA1 96b23535b7347b99a7408b24240ebaa9e1da5782
SHA512 951102ab09e6f2d73400f90a60e996561daee58ebe397f00a4335d6fd121cfebc15e9d9f0756dcafa686a47ba70982a8cffcf6fe09287e1d89ae36a5bc6be7e7
SSDEEP 12288:mLJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mLJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BF865C50CAEB7608B5C3E9F51EAC137E56981008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 858be0581fbbf86682fc34344572c3ea4f448772a9dead01d2faeb0ad72f7932
MD5 af5b77b16d1e1a7ecbfb0c7453b8924e
SHA1 3c22e20e199929774c01be8ae1cf6781facc3dcc
SHA512 2f18a87d32a2e27c32da6ad3765f5519ccd4cc34070d2a6d84d36ab5e8ec8da240bec8f3920e49865ac659aba47f0be0b86df27ba6cc1257cc952e213d419b26
SSDEEP 12288:VeBNUbTVO86UOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:VJIUOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F65CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 394332bd3e016b9a6165504d5eb840bf776c77d01b342628ab37136461c41978
MD5 7ef2543f626ba8b11432c9d4b51ffc7c
SHA1 888fff294e6cd67d0c92b98ba32d627f495a029e
SHA512 fb613dfe7bcd1f8cfac2cd22d13d31b16bd4d34554e04f5d842d88db59556259140161459a748e3d6b4b07bf4396853ccbbced382e3201598710a7dec83ec3b4
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:jQvGAdlCEL8c/DRNw5CvD527BWG
TLSH
T1E0266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 42901854d5f7dd237f71ff914b6263334afa89f7f6e5e7728e6c6384fb64fdc9
MD5 e9870ce6bfb58a02f8f94730fbc16bd0
SHA1 737d9c9d2bb896de50e42150037a2abbc448b6d7
SHA512 0a7cb4fc76ab0c8173a2b3b5713dab9cdf36df21cfca425bdd0e88b8abc3a234d51b25403ba055ac13eb3cc0d96af655f973b836df97e1e48d75c5f102eb9d91
SSDEEP 12288:wAwSfxL/2Dc3RDLLmt0LDQewsAj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:F0ewsAj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14375E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d9d410792964a5ce2537c5b9acf0e0eeed7db37c915a9333ac5fcf5c3081e74a
MD5 b98c2b88ae26b304052424d7f85d6f0a
SHA1 545c5f3492f89f59c84d6fee8eb433482dd0dde4
SHA512 c09114788338b32ac1b46600ccf6e908da500e70b43abca5409fe45c70e568e31f03e7d72fb3f3cf8652ab7c71bff83246bfca4cd142af20a1051d1f0ec86191
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIVQBWG:JUEtQevvqc2W1cpV2tI32PB
TLSH
T178474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3443f45bdab7a7183dfffe95c98a4f97c3dc37b2a2410e293a01dd9f2370abbf
MD5 f576557fdbcccbcc67d124f6159df933
SHA1 4efe9ba4f9d021aaa3abde2834411487fadd4253
SHA512 55d30a7387d4e1cd8de9f9e0eb19d0a514cff2cac5a9303f21cf91e6df6d39f20e5e486ddfcae40ec12f05a5e8eff9ce00297e9c3c8ec49261e243ec873224d5
SSDEEP 49152:cCbRquA/m2yL5zTfFiV+XenmE3/zwDmg27RnWGj:VoquVjnmzD527BWG
TLSH
T1AED58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 44c682b95a860ebe255948a3fab35001ca3261a83317c3ee530337e300e9f78e
MD5 7d62ef442be54c2dfed1a0735a0e985b
SHA1 e1dcdab8c58ebd4cd8ea66204efd7c2f99008eca
SHA512 dab45d874f774a1f8958b9bada7bc305aca24d1e94c2133fdfe7cd905ed51c6cc3094559a5dc19cdaea6a6068593e7608ef5f3991daa2ae04dee5fa1faa8751c
SSDEEP 24576:ZAhGL3IFoiwtA5l7S53vsqjnhMgeiCl7G0nehbGZpbD:ZAMUFoiq5DDmg27RnWGj
TLSH
T148359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 99419c11a7e27cf6a4a0c73a6af6852834085d93fdaaab2c5a0bf6cb9a16e76f
MD5 05a07079f6eddfdac72fd5fd25868f14
SHA1 add44eab9651ccd83340d137f775a021bfe4c6d3
SHA512 8d669b49aa25d1c14a5d2fff90cbeb0167eefafe959a940c0b894a435d9923945da8ffccd696ad3f0c1f2c718f04bc4a630347f13af11e4b7f109b5d27d207a4
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:vwu4OW4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A065F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 deead4909b5565c80bacf33f355bd1272c0a56803ae36aa6b1902eb010406062
MD5 fdfe87530c8a3cf01527ac0a385bc1dc
SHA1 f95805bf19d6f9b5d211668bcf4b83a1e885b67d
SHA512 223cdfe7d4dfb173a99e51d9e63a896e90d29eb785b0c7944af231501c8ce79e2035fa6bd18e2026f5192162ce67004192a35bf264002b3a1504f96c0e37c932
SSDEEP 12288:TeZ1IyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CZuVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1925512AA239820FAE163417CC5E5D609E7337C62673003CF16665AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f31380052f909001b4ec3f3107581fb8d8747255d8e870bf08c3944a5d5e9d63
MD5 5b0223638f5156f3e8ca6945bd93cef8
SHA1 0198d90a5ee565b1c1044180585e7f41fdf0133f
SHA512 474e0b8000b3bc06cea84545609ba4c73c94823a41167a684b5466bcfdf48aad5401c06e62587824c1132f4ec34409d4a24093a5158e492a8566ed4e9efbbd5c
SSDEEP 98304:qQRQyi36YOcPbLvw2gAf+PN3mD527BWG:BQyiKa/X+PNWVQBWG
TLSH
T116667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b7becad18b062657deb8ad16cd713fa7cd912a2f9cf619d9205fc25f049242a0
MD5 9a7dcb9de80076b304aa3651e68b46b0
SHA1 847871ccf58c1095a518458d106cf53e502f88ab
SHA512 aa9c7c38beb4f6209541535366bce2b33ee869214889ecfeef1ef8b3187e4b364f18f346ca36ebc8d2b91ed8297b2d37516fea695d32830ef4c02d83ba08fef9
SSDEEP 98304:JQRQyi36YOcPbLvw2gAf+PN3mD527BWG:gQyiKa/X+PNWVQBWG
TLSH
T101667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aefb43b0be155d05b2579ba558d525813c61115d4547b362e070402ac0292c6b
MD5 2801a7547a49b222d3db4b9d5ee66d9c
SHA1 d3ea7b51fddda1f317c0d86fd0f9b168a27b97ae
SHA512 85eb1eddf15f66a066a4cc34618f92f06ba661e08d236f2f62b4fac290f7961479507fb06648faef2ed6a5d7660be54e1689edfd3ac621363b8a19e37ecf860b
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0FsqjnhMgeiCl7Ge:m68Qg55nhceWu7PNU3/ADmg27RnWGj
TLSH
T116B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f5ee97f9bb0f301dd391c219c0f96ca31b3d853be71041fa0deb5dc833723d54
MD5 f101588660b7e6f3a300f5c0ad4d15bc
SHA1 2808d0f5a821327a492a25a0c07313c6e36154d6
SHA512 a0b81afe0ca5fcfa905d7bc32d0d21fd6707f08f2fede1d0242e647e04f5d94f782b63814fdf853d642a51d6a71a19b1592414c74c7e871e16f780f267ada465
SSDEEP 98304:Ny5112gYy5azzVvt69nLKnhZND527BWG:wLIHEWhLVQBWG
TLSH
T118167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e2f680fe0ad614dd4abc4803fb1c9fafeef7edbb9e428b8ea75de723842f7612
MD5 5569349fa829948e3db64a301db9d984
SHA1 1395024a2749d11d37a69f76587cd4789cafee16
SHA512 97618737d74ba417a2262098f6790dec96f93d82fef807928705c516f98ae8e539df3f0dac1325420f30d76e308af208a638b48353faf5b36cec75f8eb8f2f97
SSDEEP 49152:cB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gllDmg27RnWGj:2u6Jmdxd2dlD527BWG
TLSH
T107D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 343c146b768c7e94ed6618e440d3441fe93cbb6c8aa9882f96ac5a1432561ae2
MD5 95f4fe95da6a03ff3bb0e278fb3c76a6
SHA1 3518c82e6e9eaa6c32405d33e8006f26f34eb6ec
SHA512 6d152b00c3c7aba425346f9ab9cd9642fd3300eed757cb0a8bbf9e82e8f7176dda3e544bfc4e7f284f14c7e1f054d0db285967e131cb05a35dc120b62438b825
SSDEEP 49152:f1hpsNoJpF1A63U44CwH7R4xCDmg27RnWGj:fmifPWRzD527BWG
TLSH
T1BAB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 76c668c4aca7f61262505c94caa37a1a96f11c3a216ecffa67706b8148b58b62
MD5 c0b3c4202ab90ebb9e4c4b7707d149a2
SHA1 3ab67992527ba0d9337a6dbdf05484839589b584
SHA512 793fb8ec5bc483ee753e84808442d802eccb2a9bce8cda0dc474b5c76946b91e38ee0868aa4b5c4c0eac4a0e5fd46fc4615980a75014cacace12b8bc7531da91
SSDEEP 49152:2SuZQIY0Be2KcRVtOnks6NMHqJDmg27RnWGj:Y5dKii61JD527BWG
TLSH
T14BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 60e5a3f98654fa9b374483223dc8f3cb3370a7c00f6f952dc02cf309b25f802a
MD5 1e89ba39d79fa0564e42b05454f231b7
SHA1 45e0ec3c0c35d662c339f511c5de7c733f25d5d8
SHA512 02e6a18a57e5ffca7ec6adb9e9fc40db9d22142aa245b6b2afa2e253435e4a9e77356d61293185b88f527f4ddacb73e8ee049feda03d26d262f63618c534ca91
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5w+Dmg27RnWGj:2X2imphnD527BWG
TLSH
T1B795BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a4577bb82120618eae452ec827566da815f2f0bbc0edc9d2896b02413387fd03
MD5 3f2e9da5281da1e6b14baa2728ac82c1
SHA1 64f04d920e3503d81fbb3b640c170c6ec01ecf88
SHA512 2f8fac52fdf91740f4697d2ac19005742852ddfdf2866d18be1a0975681a25e1a8af5e074f1614f9d923654dfe63246c537e29c97039a430059d1e5291831b7d
SSDEEP 12288:WhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BF965C41CAE62648B5C3E5F10DAC073E5BE92004937A977CB9EBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8a97cd8a5bc2aec283cf45c2e275f850cc3fb4fbc2d405e1df1754385440edb7
MD5 f5942936b20ec9652805d7df745d1e55
SHA1 e01834351a91b6f6e50ab26d71e7d92282bd8bc1
SHA512 bd743584ad6c049e1927dc24a56765c0815ef4c3b0d655bbf2b24d64bd218b68d0f82f2755dc759a01994e9ed9364129266e668408e0bd49a15fd44dc98e35bb
SSDEEP 12288:bAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16E4523BF965C41CAE52648B5C3E5F14DAC073E5BE92004837AA77CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 433c5d77e85cefc552f729078ba6fbc03b323404d903f19b1ec75f9721cc1d2c
MD5 2ea774338f88aca8dca376bf2dde87a8
SHA1 65cfd9ecd639bea95fd184a4561364bd0780c50b
SHA512 f819087e5d5d0e54a16d032d2c83a6ce5baf311f602bd17201fb965d19fce4457e504e26e746f65ab709706ac5bb417cd2d89b6641d953101e1aa020ccefea45
SSDEEP 12288:QmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC4523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 6b2d7211ecc943a99592a94b23ace13454febfb09bcb02ef8e64238be9b13f13
MD5 9bfe78e63738da5b349f91dfd418a1dc
SHA1 c4d5ae693e5cf8776d6875df177f1a5abb947583
SHA512 cdc750c31601b9ca9d9bfd0441981513ac5a911014a37af19e546585328228bbe280b118f4e11afa592e850880bd469530c4d63799cbc1e511a3824be0ae621a
SSDEEP 24576:HfwvUk9RX6wkyAIpsqjnhMgeiCl7G0nehbGZpbD:VMnYItDmg27RnWGj
TLSH
T12985D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4c7ed9a62a34ecfbcc8694e1fa2ed977c0ca6a7464640e08dc85518b61029aa7
MD5 6b230813c653a65468f9c3bfe0fcd9dd
SHA1 ff883af698f33f9ec9fc149ed7239317f8b7975e
SHA512 7ef22fcd69f1d786b8434e0a0a23c89e25e0653a2847e749839909fb84ff22a2bbfa14b9522f172870b3f0f5216d2c98fb65e03cfebd776014889ab0df008ff6
SSDEEP 49152:TYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eDmg27RnWGj:mySzPGD527BWG
TLSH
T131066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 69846340a4e007a5e1b6f817c92e66d270912640eeb8ced09ad6bda4dc86d9a7
MD5 64397fc366836df054685f7b982a74aa
SHA1 5e9c4923ef7896eb6ddb4997b0a53beeb5f1c05c
SHA512 413e607e32c1f153e55309f18ebc240fccaa126c3e8311ea2e60491af7418a9eaa097db2ba37886617376cc4cf652e947adcf51716885f52751428034319d965
SSDEEP 24576:147Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYwsqjnhMgeiCl7G0nehbGZpbD:147JUQjTirIhCnDHUPfF/uDmg27RnWGj
TLSH
T1DD65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ac736d408631b263f1c452d96a205bcc3cfac58a8e2800adc9dde04281a0b108
MD5 03fbc45c40ca6c939cf5e7ad5232862a
SHA1 2a1f25c1caa066136d60c9303590b7fc01413842
SHA512 da5bdc3d938f591f98110b810a6d0c3673a7001f69b32b08864e3e753f98c87d24a5badb1a5f5eef9b9d77c0dcbcf9331b009760e674dec6b3775968afa3b985
SSDEEP 12288:3bsfVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE55012AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 d5e989007504ceb3f397338beed8bc58aaf7d44b7496db0c53afc728d4387cf6
MD5 d1c9266d24e8c581bd73607bde90cda9
SHA1 461c68bfc60032f3d46aa49fd0e1642dde8fb27a
SHA512 160b5a35a51e9bcb497ed3c5cc6b92413de3fa336543aadf05854c06bee183129f075f8ed66eed670352349473409d644b275ca1b53a1a7f0e5586c42de3a283
SSDEEP 12288:GMX4279U3fZ3RyN9Sc+HJwiqX3fH1sIQQSmje9v84QGsyRcK1Tgf:GM9ZUPihniqXfmIQU0vjsEch
TLSH
T1E2452841B66AC78FC6A940721E33D1CCA7707D41EE456F0373C89B3FD572658BAA6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 321KB
SHA256 04aa3955cf6f146781ce9f86c1ec06b8af7c7edfb535fe319744fc65929d5afe
MD5 720201751de8b5d87d871e4914297030
SHA1 16b553caf2bbc50c74b710b6a4d996b1dc99cf09
SHA512 374c8bc089c3bb60ad3ddd203412f4897c335953840a6bab6c22dba0c1d115f342c234123c7674a021d4faf1cdef536f29681e4314caa94cdf9a29fac8220850
SSDEEP 768:H/TVBlToOlTPBlTz2+EQMbmk/TzlTpBlToOlTPBlTz2+EQMklTSxS44BlToOlTPg:kWzuhTZjbvU
TLSH
T1D7643212B750F229C4B780BA5870D6A7AB3DB523CE1287033FC51A99CCF21876A76F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 233e28795da8d688262d44a61ea3f045f49f599c5f3481777d0ba6b9c55503ed
MD5 ba2ac82eb6148984bc5047ac75c39809
SHA1 c30debddf267b4327ce45665909c2356af57b2c3
SHA512 2c8bb04269dc098b84b076119bd0340e2a623798ef4a777a2e4b28262671eff5220b3b699f270c08e3f1edb45bd17f7a062625e4d5add419b0aaa3b8a83a7e5e
TLSH
T1B8518B41033D9D21FBB637BCA1E321683FBCCAD99F0B6E9D186990748EC7B0681415E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593203.TMP
Size 3KB
SHA256 1bae3d94b37bcfe744eab4a7187a4469dbdc0365844b069ff304451d71bb1905
MD5 25a977652cd7025fabd723ec35a22108
SHA1 bd79e68a56edfc81c8c2ebd3934db6a94aa7a37a
SHA512 822795d3cb2ef85c79363bbc00f513ef7b8a41723175890df5567eadeb02295615e97fb041842b1f9b493ce26e0b9874d7438a6ff5458bf41da3e01aff7fb1b9
TLSH
T127517A40073D9C11FBB637FCA1E221693FBCCAD99F0B6E9D086990748EC7B0681415E6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 08f6499d2414e8d23ca539964eda993be96ec66a4e7c76aaad93108f08b9dd1a
MD5 2d4513b4e5f9c6fe0b504869a85fd317
SHA1 4cc833f69b1fbe8b61d70c22e15ad666c4699c21
SHA512 ec8b91d7e812adefa33176f562b708d157c92b3b8104dcb4a0346f96a1b1f0cd926c0320b929cfaa700e90c5290bd3856ff56085d5836b14116c04b6bc41cf04
TLSH
T19B51ADF3C2E8C66D891155F0BB147E1BCE1D0954832C3D5AC9E4AF5BA3E2471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d46875b6bfcea534a340c7d5304c8e0c11cdcadf2406aebda330d4409e9d37da
MD5 a57156204e7f8a3efa5f05786ce6c303
SHA1 4672e10fe4f377bbaf2887520a96d77cf1f06778
SHA512 4632b30a85f3c37f5e46fb17f2446868bd8fc890a4509a279c956a3a3503969ee4b7ef87b3e3397c483f8e5212b29b2a8f6b7d1c7306b7282a304309f477714f
SSDEEP 192:sxRLROyM/jK1Ml8wc1/fvs1o2JZ/5CzoA8p4T/g6+WNIYYMHYuqJ+GRIgDIdJ:sxRL0C1/fvsq2HZO/5I0qJj6
TLSH
T14D62D915AA34597BCCCBD309FA457F53D6F85462B2905E48AAFCCA0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2e69e02229c6726241077beca763d1cab6cf12517463cc1bfb87698609de7515
MD5 25046df487681514975a1429c3169c28
SHA1 5d2f98cf4fafbbe1bbd04f36f8f37c7503c804ee
SHA512 a28f4735db3bec91cf37939896115e2263ee8fe341affdc2c99a6ffa13bf7e230c54cfb9a5a57f913c156d827afd6fa6dad791fe11b64ef9eb25514441ec1742
SSDEEP 192:sxRkROyM/jK1Ml8wc1/fvsqo2cGq5zoA8p4T/g6+WNIYYMHYuqJ+GRIgV1J:sxRk0C1/fvsP2fbO/5I0qJjp
TLSH
T1F262E815AA34997BCCCBD309FA55BF53D6F85562B2905E44AAFCCA0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d9a43cd5b1cde574b371646645907a7cf0045820e2d0d8be2dc98f0e92429a44
MD5 c2c877f62d68b6f550d2436bf653f6d9
SHA1 18a19579b7c23f1dddf2e8db80eb57d1e04b138c
SHA512 f4fa7b8c6606892f56fabd5acae4fbd4d3d9d9d32fc9bf3ad6872032cc8d769f8c5b93326a7816cdabacfb284583dd1280364bf278450ed6e15936536867fc43
SSDEEP 192:sxRLROyM/jK1Ml8UQ8c1/fvs1ocJZ/5zezoA8peT/g6+WNIYYMSYuqJ+GRIgDqdJ:sxRL0qb1/fvsqcHdc/5I1qJjk
TLSH
T1F862D916A638597BCCCBD309F641BF53D6F85562A2941E48AAFCCB0C05E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 83365bebafdcd980f4e417af44d169aa445841e883e2e56d9b6eb3f6137852b4
MD5 36f765d6f963d49e96c369ff3147222b
SHA1 35b849f14530f8647dccc1c52336e434c2bd43c0
SHA512 6aec0d3d7226d4333344623f8b431f5a55862620c4172593de4926bef60cabe0390cbb858deebee2fc305d64060c23bac4058751247cd52c21adb6c63cdf21fd
SSDEEP 768:j+8u2A7pLuL7q7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVeBJ6Crol50:j+8u2ME7q7WgNVfq3u1jadH6Zl50
TLSH
T1D4E2DC3B680CCB7E4F804DDDE829BE9A6DE801CB56D8CD5447EE850C03C6BEB551A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59cb64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59cb64.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ff9f60e5a560dfa1b7aa32da74a7ca02022c6cdc79839edd7eaa53e7db227a9a
MD5 ab8746415237a99536c2f89d292a4634
SHA1 31373e6d1dcdf9cab54849fe93ad9362b76e0c5a
SHA512 c5165e22ed2d34b47e6f5f962c5a1b5485d1c674a6b408302961aca5bd94d5db3bbebd177c927c8adc587e9cedd1756c812fa74f29b6fe8b81d3104edb407e86
SSDEEP 768:2j+903L8gaffqfDQfUyyJ5p3EFlnNMLmOvOZF:l903qfqfsfqp3EFlSCocF
TLSH
T102E2AE31A8A09D638DD6D7857A4B7787ADF45673D6802E48D8CCAF0E44C73AD270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 25b4cbccc7faceacc5da797d1944f7be540df0172edf27760369a90469ea09d8
MD5 52da397652a62e0ab4a0984930d029f1
SHA1 fd7c87157017bdf47fb9734ec20214740afd2173
SHA512 26d41db6ae66f91ca5f8399a508b48017397ade286a125845f8ecfd12b614d31616bf9c9966f489345d156bcab68d15049a8e5bb693c35be090ffd847b9d30f5
SSDEEP 768:GjaeqD4MlshiLdMmq378gaffqfDQfUOyJ5p3EFlnNMLmOvO6UTR:GqcjhIdMV36fqfsfMp3EFlSCofu
TLSH
T11803BF35ACA09C638DA6D686764777876DB001B3C6D57E5CECC86A0E40973DE270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0619582dadc191ac1a4e38f09f561c08dddcc907d3a32ecc4093444c249cfd83
MD5 1b62a91b4dd7ecb701900fa63cf60dc7
SHA1 478027cb817a0b0923f0a195f160e0bc6d424169
SHA512 ce58610ff1d1dd52c6275534a0659b5cd9517a3135b92d33bc36cb8c01875b602c9ddcef3dd3196bb3914b7564408f1ed5869372c2cd9ce6224ec5aa2de4dd56
SSDEEP 768:UjaeqD4MlshiLdMmQ361gaffqfDfyJ5p3EFlnNMLmKXyjWtTzTb:UqcjhIdMH3OfqfEp3EFlSCQyj2v
TLSH
T10003D03A98A05C678CB696C5764B77976EB04693C7913B48DCCC7A0E41AB3DE230BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e90d42d8a6e19cea1a5575ea6f04216d9b4d16965f579eb34e08153d0976cdbe
MD5 093a480d3f69c2f92454e9f108688a22
SHA1 623797b4b9a7797f3696e1a45426658dede665ec
SHA512 9db3ef48d2534d296dccdfcb5cd075582e6013d4f90c910ce35151d4eba1541709997e46e863b898f880978056117640749bdc8773b7fbc890878a170054bae8
SSDEEP 768:wF1j+9E31wgNeXfqfDQfUtyJ5p3EFlnNMLmOvOZF:d9E32fqfsffp3EFlSCocF
TLSH
T15FF28D36D8A0DE679DE68BC5BB0A77879DE05163C6C4ADD8D9C86E0D00C72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

be43b0e2-f3d0-4d74-acd9-02525a079d22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be43b0e2-f3d0-4d74-acd9-02525a079d22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5048_1357240574\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f2b82899718cf620a579bb7bd6d686e0b2314d0d0a098b6837dd49bd0e527549
MD5 1958d0e222a14b19e975a9f6891e8e5c
SHA1 318da4503864ae75b2ce6112033a5d1b1edda719
SHA512 75df20b0b7a030688e35e7c200edcf6676ce220c9c920507ef3d0a21ab48174ad9827d1e242a900e82b82de8563769cdf975a9d7070661942ce7b021811a0f7c
SSDEEP 12288:T07dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11145237B934C518AF93605B482EAE12D680B7E669F1044C3BA5778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 546fc152212ee8e9d3621ff56a3d933dfaa54259fefd650902eba17980be68cc
MD5 9b23896b485b020d60a929ae838f2a67
SHA1 f0eb8c1b4195d53d4758387f9766bfee1f9b5060
SHA512 8a7efa494568f4f4d304a0b2cf0a1ed343e8814b4aee9e4c6f87ed76dbda352e6ec7ebbf9c7c27362a4db7bacfff9250a5bf4c671036dea74ba77cda86c284c8
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYrsqjnhMgeiCl7G0nehbGZpbD:ygb4mBIBhGFsDmg27RnWGj
TLSH
T1FC659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3cd9d84f9ddfeeb8ec2c3a3750662ac70cab16f62428567bce3336a87e1db531
MD5 039b221e56b6e344b28b0571f9bfaacf
SHA1 ae32f1b716cbe12263f4dc4ea28bc736467932b3
SHA512 124cad51a6eae59ab7cc5901fcc00aa7f1b8388d0023621965e282e53bbd69476968096408e15432022d5e82b444bf8f288992cdbb63d6416eb9ed2f196cb29e
SSDEEP 24576:vG88u8FpJqH1bzria7/mgsqjnhMgeiCl7G0nehbGZpbD:e7ZFPqVea7/XDmg27RnWGj
TLSH
T17C85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 15078b21c821985760e379aa522fb0acd5fe45a68a20ddda7e0c1875c3dca3ea
MD5 9f912b99289cc2f5a4166dceae92cfc0
SHA1 91db2cd597708404a9897a35c825497fa6e0137c
SHA512 66aea5ec4e3c35e987317bb6b508ec12fed5398572e8dd8c7c7eb83a4de3bfa1d41b4ae4d387bc9b88cee6c5ba413db03b9a48c773201d4f1f32c5fdfd1f51e3
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYDmg27RnWGj:kG05lO43bFD527BWG
TLSH
T10FD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9fc9fdd674d2dc66c6d366eb107390e8f54ac2750e133325780a46ccf6aed475
MD5 08a164251f6d37c45bd211dd64fac396
SHA1 33d1e1db2a4e471ea09d74feb57ddde591bf15ab
SHA512 318a48de7ea8e9566ad1864aba8b49f1ced82a9f0baf474baac61c6e8ecebdedf0cf67ea73cfaf4fba45a3a01f8abf33fae8c4debb295c6507440666797ab2bb
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKsqjnhMgeiCl7G0nehbGZpbD:+a5POZ3BJt2pasx2+mADmg27RnWGj
TLSH
T18965BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 52d7458b9ac703b99dd763e6abf010b7ce34c860c5488f68ea51b2d112d62a4e
MD5 7e4fe75ffd344247062fe438f5bb0af2
SHA1 c7938b36769fc47c90808de13ebb8acaa71ea559
SHA512 d69e6ffac15156a699c66ecce44a732955ac097c0f3b35828254773df94d4b2704db4aa68207820372c70009391279f7361d3679c7c3dfef64420d20140515c2
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkYsqjnhMgeiCl7G0nehbGZpbD:GNc/zEOVHF3Dmg27RnWGj
TLSH
T118857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 333aeaf99c6c603f5e81fbb6b0cbf1f77c09c5db95a1cd666eb7cc156b6a39eb
MD5 98cf3c0806b835292d840d68353476d4
SHA1 831a86b3d006445faeb6d693d159fcd898c00789
SHA512 ca98ac310c4761418661150405110c4f2c6ab2eaf1ca7d64c73753cf92959d065673adf089adb9057f731ddfcf05f65a81731c2fea56a832b85391920fa1f266
SSDEEP 24576:mTkNvNnaFeYhJNtmZBm1sqjnhMgeiCl7G0nehbGZpbD:mTMwBtOmpDmg27RnWGj
TLSH
T18E55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e728f316ade9db2120ea9314e37db2d218518566820347261afa4b9f3b869578
MD5 3cda86809e0f7b010b6d3bd150fa6476
SHA1 d782b00080f3e72c2ed3903fa1d22f87710e2911
SHA512 a8d63f1cbe1477cafc6db5d26ffef6d2ccda43a68451359c9233b9dbbe35a5cf93435a618043bb166deca43d56ba9afa2f0cbcd90fead5ed0aa2bf54b9155edb
SSDEEP 12288:EHvUrBFrEjwaQ8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:EPUr+NQ8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16065F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 22f45804671a67ca718d47cb5cc4f024a8048120e0ca1ec1172c5f3e49f874f6
MD5 83f6781ad7e595dfc684e273e5433582
SHA1 a95b7be70cd92a57c8ecccda519fc498fd5ad1a2
SHA512 c89b48659a1b09797b6286aedb14d098b6f63bbaa53a75d68fb6d9ac908fe1aeec4c9387f98afd1e6d126706bab8c91e6a6357a7925198c6afe090ee45b33111
SSDEEP 24576:RD3FHshBIYQgABsqjnhMgeiCl7G0nehbGZpbD:RDVHeBIAAVDmg27RnWGj
TLSH
T17075E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-81-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1208-62-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1208-101-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1208-102-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1208-89-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1564-479-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1564-158-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1564-482-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1564-484-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1564-159-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1564-165-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1844-141-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1844-401-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2428-512-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2428-172-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2428-170-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2428-179-0x0000000000D90000-0x0000000000DF0000-memory.dmp

Download

memory/2660-1-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/2660-22-0x0000000000400000-0x00000000005D2000-memory.dmp

Download

memory/2660-7-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/2660-0-0x0000000000400000-0x00000000005D2000-memory.dmp

Download

memory/2660-6-0x0000000000C00000-0x0000000000C67000-memory.dmp

Download

memory/3088-124-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3088-126-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3088-98-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3088-103-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3088-111-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/3204-200-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3204-184-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3204-198-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3204-193-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3204-185-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3312-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3312-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3312-129-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3312-360-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3680-120-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3680-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3680-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3680-313-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4736-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-145-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4736-31-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4736-25-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/4736-33-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5892-147-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5892-153-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5892-146-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-562-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-447-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-560-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/6056-209-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6056-513-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6056-203-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/6056-202-0x0000000140000000-0x0000000140172000-memory.dmp

Download