e0c6376770dad343e2a8aa4bbfd201d3040b967ea749d5e320ae849a4a0e4f43

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
Size 1.7MB
Sample260720-s987rsfs3p
SHA256 e0c6376770dad343e2a8aa4bbfd201d3040b967ea749d5e320ae849a4a0e4f43
MD5 743d034978fee36abfe275ec36f85320
SHA1 918ceaf82b37e9800819c6a4775dbe6fde4caabd
SHA512 c64abd51c23a85f77858cfe67d3e8f038b9b12f1b0189ee971a181fd508bdb6a99fb0ecf3c3656346d8ffc1b4b9387a9ebca6c2fcab4d7518edd9241be44fd8e
SSDEEP 24576:YqQqjm4zzYySHz4yxknw4FYnshx8OfVe247:tjm4zsysx4x8EVep
TLSH
T1AB85F1107BC5E072D29621710A26D37966BEF8604B3247C7B7D43B3DAE706C2AD3974A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1348	elevation_service.exe
5664	elevation_service.exe
3036	maintenanceservice.exe
4816	OSE.EXE
464	PerceptionSimulationService.exe
2880	perfhost.exe
8	ReFsDedupSvc.exe
5140	SensorDataService.exe
5784	ssh-agent.exe
828	AgentService.exe
1144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
5676	verclsid.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a80ac4c6d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	OSE.EXE

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_747757289\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_1715651218\manifest.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_2135866276\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_2135866276\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2468_747757289\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3360	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa055c8f5f18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000baf038d05f18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffeb91935f18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5e5efcf5f18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{EFEB5199-7F1F-405A-9231-F40B3FD6AFCD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
4816	OSE.EXE
4816	OSE.EXE
4816	OSE.EXE
4816	OSE.EXE
4816	OSE.EXE
4816	OSE.EXE
4816	OSE.EXE
2852	msedge.exe
2852	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2720	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
Token: SeTakeOwnershipPrivilege	1348	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	828	AgentService.exe
Token: 33	1144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1144	SearchIndexer.exe
Token: SeBackupPrivilege	8	ReFsDedupSvc.exe
Token: SeRestorePrivilege	8	ReFsDedupSvc.exe
Token: SeBackupPrivilege	8	ReFsDedupSvc.exe
Token: SeRestorePrivilege	8	ReFsDedupSvc.exe
Token: SeBackupPrivilege	8	ReFsDedupSvc.exe
Token: SeRestorePrivilege	8	ReFsDedupSvc.exe
Token: SeBackupPrivilege	8	ReFsDedupSvc.exe
Token: SeRestorePrivilege	8	ReFsDedupSvc.exe
Token: SeBackupPrivilege	8	ReFsDedupSvc.exe
Token: SeRestorePrivilege	8	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1348	elevation_service.exe
Token: SeDebugPrivilege	4816	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2720	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2468	2720	2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe	92
PID 2468 wrote to memory of 1256	2468	msedge.exe	93
PID 2468 wrote to memory of 3360	2468	msedge.exe	100
PID 2468 wrote to memory of 4844	2468	msedge.exe	102
PID 2468 wrote to memory of 4844	2468	msedge.exe	102
PID 2468 wrote to memory of 4532	2468	msedge.exe	101
PID 2468 wrote to memory of 4532	2468	msedge.exe	101
PID 2468 wrote to memory of 4532	2468	msedge.exe	101
PID 2468 wrote to memory of 1088	2468	msedge.exe	105
PID 2468 wrote to memory of 4524	2468	msedge.exe	106
PID 2468 wrote to memory of 1088	2468	msedge.exe	105
PID 2468 wrote to memory of 1088	2468	msedge.exe	105
PID 2468 wrote to memory of 4524	2468	msedge.exe	106
PID 2468 wrote to memory of 4524	2468	msedge.exe	106
PID 2468 wrote to memory of 3692	2468	msedge.exe	108
PID 2468 wrote to memory of 2404	2468	msedge.exe	109
PID 2468 wrote to memory of 3692	2468	msedge.exe	108
PID 2468 wrote to memory of 3692	2468	msedge.exe	108
PID 2468 wrote to memory of 2404	2468	msedge.exe	109
PID 2468 wrote to memory of 2404	2468	msedge.exe	109
PID 2468 wrote to memory of 2272	2468	msedge.exe	110
PID 2468 wrote to memory of 2272	2468	msedge.exe	110
PID 2468 wrote to memory of 2272	2468	msedge.exe	110
PID 1144 wrote to memory of 3296	1144	SearchIndexer.exe	111
PID 2468 wrote to memory of 908	2468	msedge.exe	113
PID 2468 wrote to memory of 6048	2468	msedge.exe	114
PID 2468 wrote to memory of 5500	2468	msedge.exe	115
PID 2468 wrote to memory of 5624	2468	msedge.exe	116
PID 2468 wrote to memory of 6048	2468	msedge.exe	114
PID 2468 wrote to memory of 1884	2468	msedge.exe	117
PID 2468 wrote to memory of 5500	2468	msedge.exe	115
PID 2468 wrote to memory of 5500	2468	msedge.exe	115
PID 2468 wrote to memory of 5624	2468	msedge.exe	116
PID 2468 wrote to memory of 1884	2468	msedge.exe	117
PID 2468 wrote to memory of 2976	2468	msedge.exe	120
PID 2468 wrote to memory of 2976	2468	msedge.exe	120
PID 2468 wrote to memory of 2976	2468	msedge.exe	120
PID 1144 wrote to memory of 772	1144	SearchIndexer.exe	121
PID 2468 wrote to memory of 5812	2468	msedge.exe	122
PID 2468 wrote to memory of 5812	2468	msedge.exe	122
PID 2468 wrote to memory of 668	2468	msedge.exe	123
PID 2468 wrote to memory of 668	2468	msedge.exe	123
PID 1144 wrote to memory of 2972	1144	SearchIndexer.exe	124
PID 1144 wrote to memory of 2876	1144	SearchIndexer.exe	125
PID 2468 wrote to memory of 6132	2468	msedge.exe	127
PID 2468 wrote to memory of 2224	2468	msedge.exe	128
PID 2468 wrote to memory of 1940	2468	msedge.exe	129
PID 2468 wrote to memory of 3212	2468	msedge.exe	130
PID 2468 wrote to memory of 3212	2468	msedge.exe	130
PID 2468 wrote to memory of 3212	2468	msedge.exe	130
PID 2468 wrote to memory of 5604	2468	msedge.exe	131
PID 2468 wrote to memory of 5604	2468	msedge.exe	131
PID 2468 wrote to memory of 844	2468	msedge.exe	136
PID 2468 wrote to memory of 844	2468	msedge.exe	136
PID 2468 wrote to memory of 1016	2468	msedge.exe	137
PID 2468 wrote to memory of 1016	2468	msedge.exe	137
PID 2468 wrote to memory of 2272	2468	msedge.exe	138
PID 2468 wrote to memory of 2272	2468	msedge.exe	138
PID 2468 wrote to memory of 2272	2468	msedge.exe	138
PID 2468 wrote to memory of 2852	2468	msedge.exe	139
PID 2468 wrote to memory of 4864	2468	msedge.exe	140
PID 2468 wrote to memory of 4864	2468	msedge.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_743d034978fee36abfe275ec36f85320_elex_remcos_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://myzong.mbb.com/zong_portal.html
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff914b0c188,0x7ff914b0c194,0x7ff914b0c1a0
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,13493358949103653681,4154265744644487090,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,11457034182571479365,8808735118204000700,262144 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,11721334350052077742,17934740834085183111,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,3679745085056146431,2720083024820719444,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,13640668045952242182,4348879423478844151,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,8669808437111562619,3233866688452938598,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,10575277320656378411,10221945587622665192,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:9
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5396,i,1829340845633737375,14510621487837358914,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,14024015720200197400,7441266972688762500,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,14024015720200197400,7441266972688762500,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:14
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,17862501298270150585,12818983081880387540,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5660,i,4858479470274879431,10369311590122195080,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
    3⤵
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,11459151669258421352,9265383965710569414,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
    3⤵
    PID:5624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,14840118492552385338,15578623442693362939,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6128,i,6755860291902707280,10643298317420446420,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,9584870419736653312,6111013581533046002,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
    3⤵
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2950208001473965774,2773179120611106051,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
    3⤵
    PID:668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4056,i,12107551199985009822,3157666853836024720,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4048,i,14452347777448367395,7182548811432791187,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,8583839378473794450,7792586835424009816,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2152,i,4437715535164299722,13666863221883654726,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7538235598340153594,8080660644209793904,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:14
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,6130909103939399275,2291939333890596834,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
    3⤵
    PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,14130070993202425526,2845171077517790960,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
    3⤵
    PID:1016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5924,i,3637938347641136499,16502358621623412706,2097152 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,4946795927849767276,12608894680953457145,262144 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,9452083025286414491,10290996085165084771,524288 --field-trial-handle=2508,i,9360156062608299695,8017977694447540677,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
    3⤵
    PID:4864

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5664

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3036

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5140

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:772
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3048 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6028

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 44723839ddca264db8752f9858e45950dcd70c7a014be848b30f9b92d51e4d03
MD5 926572f4a8a23995dd83fdf77f63aea5
SHA1 b22857ccc564e4d38bc008bbf5a3a2ef03ee1a12
SHA512 76334fe11b99e8b7dbb6ed273e84e7bf53907a4444bd7438f3b6a009ffadb640531ba3fff9e25e85b66c8243763121c305e1dd204943d859b517055eeba6b190
SSDEEP 49152:9b+632BuPkFKRrdE6ohmstBhuXjfS4LWxndx4x8EVep:D3q6HjBaix8EVy
TLSH
T163D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 35a45dde58d90a4670ab45c77b1b8da4370d8dc662bb4cc676bf05ba87b0f906
MD5 80cb87d59d5b9c98405ea3eaba944f7f
SHA1 a1630bff0e58e70904f18b4a56e7fb174f7825b5
SHA512 c5ef2a6dec92b01cdafcc457c9ce4ba984593e483ecfbbfb11ca1188191d85f8c93005037a0c70025d0385f68e6dac9778348d58463e8cce696f8a02eaaa57cf
SSDEEP 12288:e1XLsswWkxy2lRq2czAL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:sXYfDtczALyxknw4FYnshx8OfVe247
TLSH
T1C975F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 50f93bcf213a6adfee22d14bae73540e62e01217c6adfa3ea47248d0c21d0ca5
MD5 180649db77970d8e8135c7e76a8e55ed
SHA1 10acd9c988c431e861bc0e9062571defc8f123bc
SHA512 1b85b49052a531f55c788c205d4b134382c3c15d784911f6f23a2c2b4e83da8482ba7b87ededc409544f6a29cf2852677c7d45c813f60746ec374893574d9e7d
SSDEEP 24576:60Le5ji0hmxFrMwyxknw4FYnshx8OfVe247:6Pji0Armx4x8EVep
TLSH
T13495AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 49f7d92baf15f604b4f1a63868e8c370ad095495a2e57deb7231b61d1503309b
MD5 5b3e71e5c8ceec2d68ecd3e44a52a028
SHA1 50314797ad47eb1c938584359e2391ad505d3a0e
SHA512 31acfd2076eec6ff7a887e9b6e36c70a126779a1e7feb23927e441d01cddd4f0b89162d1a0d07bac7d8974f69872688c177be9ae2527b22218e49035344faf08
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuSyxknw4FYnshx8OfVe247:z/ezSC6vUzPvxHjyqx4x8EVep
TLSH
T129756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c809759e3df9aba7b45739af699333f4da76c979c6e3f78ad5b5447e390840f
MD5 a5ea61f02ce27b50eb6db7fd6dd86c79
SHA1 0223294372088b0a14cc62aa8838d7ca8064d90e
SHA512 d02c9b1216cf68e99d063a72bd2f593fe891f9127d2d3bc2f21ca91dc6ae279827b4a80a691a253f212434f8fb5e67d868881f4183a5f348a8606643c19f4bb2
SSDEEP 24576:LVbqPb88hv/l+6Zyxknw4FYnshx8OfVe247:LVO88hXl+nx4x8EVep
TLSH
T1F6559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 1746c8a0123454a4848149e16ea715599412f4125d51118d0bf58cad1fa4eaa1
MD5 cbb4037866f46a763ac53bbae5b7e031
SHA1 d66f36a63b3300b6129549b8e5e3f09e2f34d307
SHA512 641d212c575ed5668b75ab85eaccbdb0698626b4f8233cd11fed73f63cc0e6acc685381faf80c9a5fdc45216324b74561b3e48de17001278209f6afe760fe348
SSDEEP 12288:oNE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oNEyxknw4FYnshx8OfVe247
TLSH
T13365237CA7DDA4E1FA5E14331B7572622616BDA0DA74C11BCB78B14EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 dbdb697d8798543f0c02c2211fdce10b4dc4cb5046efdd1cde52eff4b03f0397
MD5 b4a163b84b8eed59041120df4fbc1c4f
SHA1 7dd8140144f3c69427ccfbe6b8bd0dea31432b7c
SHA512 adda1b797a07e12093cbb866453afe05ca96d33e6b771918b8d9a1d12bdc8d17d57549bd06c00fb0d027b5377f73d39485a41f505c58bf9bf82f07496dae47a8
SSDEEP 12288:+eBNUbTVO86Uh+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+JIUhyxknw4FYnshx8OfVe247
TLSH
T13075CF7BEE28FCD2C27E5DB95B918200A76274704F6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 12f837bde3af708c0076c13837789fc055986e3a1a7f6ddb525496963bbeded3
MD5 8d5389b225d6fbfaaca74068f51a2c81
SHA1 77958398322dcc64b8e7dcc3fde53b50e1c7ccfc
SHA512 67d4e61203e2d96e249d3093bbe637909edba9b21b37614be392bc746c03f4b9504baccec1559a66c32414c28e77f5445f696ee36dfa0b5d322f768a291c5c42
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THS:1QvGAdlCEL8c/yRNw5Cdix8EVy
TLSH
T10B267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 9b6cd80918a7ee67dbd600214da9eb771436eb00660f101d107a36e588fcfb9d
MD5 b218d0d37033ed6b54737fae1d2276ed
SHA1 809676041f07dc56ad520a27eb8dd893f556da51
SHA512 df7b0b029dd26a8b29ff38274402db6119fa5a3360c99df52c73d51df3d69e90bd5c4e1eb5e9a9dc2169c86e1cff0b328acce2e04b16f53284f0707836617bea
SSDEEP 12288:zAwSfxL/2Dc3LDLLmt0LDQewsAjz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:s6ewsAjzyxknw4FYnshx8OfVe247
TLSH
T1F485E030FE74E032C6BF0DB21B36D716142DB9604F611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f0c0d8c7ac0e003d273be3423305a912338d46991b8b74808be20da222e8deef
MD5 ed79acc4c62a6634eda0c5d49d717b03
SHA1 0cbde004fb3af08b64c3f15e0fafc64f7d34839b
SHA512 45831f08b4bbc67e67bdcbe5ce3f952d1030c7016600ba20f1f221de2d89be927dc440f1f7205abd1189fda0ad757c83b3c5b45fe3fe2c835e37cc701b3e62d2
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7:wUEtQevvqc2W1cpV2EI32
TLSH
T1FB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3997a2b0f7dd006d9f7bc4a7c07e583ca521c6e388425bed2f945c43a6043efe
MD5 e774280ad8b8e833ef646413b6cc5712
SHA1 7fc5f744b22e13f6f10f634f4bf5be4d461b55b7
SHA512 5279fbd9499c06e1f3f7453b866273da77e3248ac16601d3f4329c22c0b9667a31aa7eb8da087c42b4d41499ada23b4b0aa51306ae52c009a43135fe226be0e6
SSDEEP 49152:ECbRquA/m2yL5zQfFiV+XenmE3/zWx4x8EVep:NoqtVjnmRix8EVy
TLSH
T14BD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cc628e9cb0e27318571027fe1d83c29b200a7f26f01391d93e495cf066d2f915
MD5 f31145ea5ec592142db05e9edaa95111
SHA1 5ec9cd2facb7a98a03b9b43e3e9ed955c9412da7
SHA512 1cac759e53b1abe714806fb0b14e77294ca84676daf127f60af90d4695e86b2f335c8264c97693189e5b2714405e665b911e30c8aa6b326a0c76b987081c3dd4
SSDEEP 24576:3AhGLJIFoiwtA5l7S53+yxknw4FYnshx8OfVe247:3AMyFoiq5hx4x8EVep
TLSH
T1C535AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 4b73846afa87c494d83cd3a26f8a05800305cd9c909cf28cbdaceae01601fe30
MD5 714b2aad568211fb2815eb295e4d1d40
SHA1 a4f70dba0cbefa59604cbc5f53212f722cb5a9ea
SHA512 f3426e6ed281d67d00fb9f04e11d501e085d8991d90288e7bbc41936ca0b66176ab5c10247952142104c9682786846c72f837b4e72627a67bef31735001a7073
SSDEEP 12288:xmw5HEjsChNoBFgl0WDm+Cy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:swuFOWfyxknw4FYnshx8OfVe247
TLSH
T19C75F14977E81CF9E9A741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 844cc9ec37707f43501aaaacd092ea36b1a7ecab59968d082028cd7e4e32265a
MD5 edbb629de956273cf6f7c58e18794c39
SHA1 3e5d5e88396154d58d39b1e7fa4211b523f33c9c
SHA512 8351d1ac927fc2cd662ccd5e41de6b4f15c40a0f67b47ce082f2a95d521cd1a06256ea7ff13a8c48bdafe0beb1b0295a635e11be5a0ab9bc77ef4ad3045c44ea
SSDEEP 12288:yFZ1IyD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oZuYyxknw4FYnshx8OfVe247
TLSH
T14F6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 338f0618a861854e0077c068494cab4d45c2e02c50200763bc5f09973cfd715c
MD5 aed28a14133b93658999928329d3aca4
SHA1 0c476952d422c6c414e193db4029fcd96b583308
SHA512 e963aa51249576bfd724ea4457d44bc772d88c7fb4a321778d7d936f6965beb2dfd3002dd154810d5da77a93f47d0b5c772dddd7dc7da7bc3e02cc57467499af
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:6QRQyi36YOcPQLvw2gAf+PN3Iix8EVy
TLSH
T143667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 078dce47fe9a7e443b5de2bcb0fb736bc6e687f82aba66a1d0fc44fcf22d2d91
MD5 66ad866f470112c169a6d99145eb20c2
SHA1 bb965dd2e1f004346656187fd8ab339d8d41908b
SHA512 d7a66369a12a7e5d27b2e09b4e181075ebe1b7c9d33d4fa0211a875dc0dd947688bfed2e42ac49fc95bcc56716ea37c64fd5a36974477bd9b43acedad8a854eb
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uu:AQRQyi36YOcPQLvw2gAf+PN3Iix8EVy
TLSH
T1E3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 231a6d242515dfd3b4b015c32eb46a4acf43b22268c07c03fce215cc88a0690c
MD5 922dff1442b39ac40ae874faf9f203fb
SHA1 c0111795f90cd2e25bc34584e458cf0de282d725
SHA512 37002c1cf2b77f679e6973ecfb197cf4fcb8940ebb9b1a6d3e7ada4f1c2300e648360e7a493e82c004b049145bf4493dccbb670708af9f228a06912af8cf5bab
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Iyxknw4FYnshx8Z:l68Qg55nhheWu7PNU3/mx4x8EVep
TLSH
T129B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 319b939fac94ffbe8522f0f62e332c840ea013da1c0b8716d52098721e78a0c4
MD5 8e3858c1c57147f94e75050d63a0296a
SHA1 4d2b2dfe7fbab0ee223ecec5ab6af5bc2d49560f
SHA512 6651fde4c6dc118b5d866b5fa7641911b7b593b0ac76fec69effed252b237a7df935a3211ec25cbec10345fa05b7566cc29e31b56c9347098ad02d3f8dd16949
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:6y5112gYy5azzVvL69nLKnhZfix8EVy
TLSH
T153167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7eaa5604b7ebe35f4e2198ce7f0a93d1e05dca3492eb1bdf5ad6da3889993226
MD5 3285d94aaac0baa94f36783b84ba6e00
SHA1 9b77b6922455603da192314c1f51004b63a59c15
SHA512 1083b28f88bb799a9f8b98c49d4c15607b70fe355381f401f788b3a7e5708c3cad958a275343cb46d90bdf1d54cefae617a662ef4f55045ba11591eeffb8b804
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+x4x8EVep:3u6JmVxd2d+ix8EVy
TLSH
T182D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9f10b5003a6885f01f11d6465e54b53d9597299e0a658b60d430ed918371ac9b
MD5 ed32bcef0ee11de79596d6d4415e652d
SHA1 893cbea2d77b53e776864c691e49b8968acadd5d
SHA512 525428a684a60c763baca43b714489c7b606bc01950c64e31429405eca13ba935d7fd6077e1ab74e60cf31822f7896244635c16381e37c4b2940043c8ce89d07
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xEx4x8EVep:ymifPbRRix8EVy
TLSH
T1DAB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c3b4ce62a7517f8a2db83bbd08352be6c5c4f118c5aad54143bff42e1c32cf38
MD5 8eaeb2d04e3c672061104119852d3539
SHA1 66e6b2ca66599773fac831fb883003089c3e882a
SHA512 de4cf1756e952926ffeab9607d688b2399f57dcb1479ad4311679796d1b0e6b747f4f152e3d36b7f925dd0d8425937e26b44e80df8c2ef0066c21b68020b8a33
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHq7x4x8EVep:y5dKTi617ix8EVy
TLSH
T1D0C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d05bf0962df0de2fa644d10acc42d17f6b8b864eeef8a8c6b20a8f161b1301b8
MD5 5bc62d36f52bdd4f28546f26d98b2415
SHA1 d60b23bd68f95e589db907ca1b4d2391a86c495e
SHA512 39454fc690c4c19dfad3efeb47c6fed0ab263b55a0ed3fe3029a8e7cb79a0e9a108de5cc393df84117b4eb23282c79c01c5aea0e4b90aac36796f96733f8d8b6
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wgx4x8EVep:RX2iyphVix8EVy
TLSH
T18F95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 a7d84e513877a0217dc661d6ca5443b81971971c6ce05154bc1bf91d3e3c1476
MD5 fe3c2d3b701822fc7a2f625a8928ede8
SHA1 cc12a4d2c8dd2f96f418031c067efcb3651dd763
SHA512 c9ad537ab52ddb3b301a39b287c8e0187d5aa2c0699f96f473623e1a498212d82eae5478dd11c2c4f07e8be914ed754f4fa82d6d5bddc8ede3f54552eacd65f7
SSDEEP 24576:ZfwvJk9RX6wkyAIkyxknw4FYnshx8OfVe247:eMnYI/x4x8EVep
TLSH
T17895CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ffbcd5c9fcfb02e2b2d767083fcdbbaaf49576dc679da5e98e82577431b36965
MD5 2671333b572cf2f0c49e9ed5efdb64f5
SHA1 e0f96a373505a585e967e9d2c4a71dc871f39176
SHA512 7a9ac01975b906d5890c522a336705a6ce794cb5adde8e924373b03007ea6e61ccada0406cb3eb57c8206839b67d463218d6d50d3a14d2e5e47ce269e41d240c
SSDEEP 49152:8YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ax4x8EVep:iySzPoix8EVy
TLSH
T180066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e63b69add7bab54acb7935163782073379e2eec6a1189c3dda71484a4646212e
MD5 e8904181f87ba765f173095d6226d368
SHA1 2b5f6c0cc88c5f83704f8e48ad4756f28acdad3c
SHA512 0a05a1ccb46db9097d9852e7abf73dc7c0d2f44926a8b0c1be58127f1754d62ff2c81dde843fc179fc830d4f42ef49b196665c29bbf5a5be51e10e696aeb924f
SSDEEP 24576:347Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYnyxknw4FYnshx8OfVe247:347JUQj1irIhCnDHUPfF/Qx4x8EVep
TLSH
T14665AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b82fd52c3391fab51cbcc85e0d4f568cb509605b63a51dd38ad13f8e5c6c9d97
MD5 8c9d43f76a3d047bdc8c7ce0193af70b
SHA1 acc4696b7b6658d9fa5fb038b52638bd81529230
SHA512 6981cecf5bada5fe4cbf6d5d5b91048a5048e44f7d70485c1766ed23289752bdf1ca6ee25e2750c4e7aec4fc9c7dc8fd88903a123cb11e6901e419dbd0dff338
SSDEEP 12288:f+sfY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:FYyxknw4FYnshx8OfVe247
TLSH
T13E75F028E29842E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4e41d34c94e4ea27b239350ba21137c0a5993110bfe419ee8cb58863810f25d3
MD5 2aba372fe661ecd1df24c7a002c7f882
SHA1 45dddc1d71bd8701dceab684672c40a7d6f70db1
SHA512 accb145e70fb5f7196f587e0796474e3494831ef67c95d2358a2b89dbc051201f11306996bce8fb1e1724feb50c4e6a422cc09f7a03420333e3646e6714c52aa
SSDEEP 12288:0VbY/acEU3flQF6iLcO2iEHsDU/ObxF9OEAv6V1pvVr8GgH:0V8SVUPCx2L7C3OP6rpNreH
TLSH
T11E352901B66BC75FC5AD40321E73D2CCAB707D42EE055B0772C8972FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 342KB
SHA256 abb5f4a9567a2dc36be93609e72211e23548f3a9390ad1380cafcd48110a37aa
MD5 5173477fc0685fe2fb2c7fea68ecf2a5
SHA1 6e101fd944e65e62d7aa0811002fa633ae0748ec
SHA512 cd1322073bb69a71088b3cf5450f801f44c3b9e3afc333a009118da675b2ac30bf950506dd891f6c481f416f7dfa9ecb2b37eac5cd29cd87d6e297c69f79cbab
SSDEEP 768:cYlToOlTPBlTz2+EQMNg/TreYlToOlTPBlTz2+EQMpgjug/TcaYlToOlTPBlTz2L:WN3pmubgc3g4wKThf16yWP89dXbK
TLSH
T16F74C712B750F21AC4B680770861D2DB9B3DB827CF115B023BD91AA9DCF21677B36B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 588d293fbac55c796256a92da0ebb1c59ccb16e6b1c9438984cabca07f3b9321
MD5 0d8e6a3f270c2e667584e2b371cc20d2
SHA1 4bd20c2775829c9b2dd74aab215eb76afcbbb281
SHA512 4d5816f121709569513b76dc9696f4448061d2882560444c78a3c0d121bdf6f21efdcbbb164d908023364f596514f44811d8bdf32a74789d57354020ab50abbb
TLSH
T196610B91D3EE09C2EB2ACDB6D8E19494B2F68C998D076A44715CAE7444FEF20D0D2F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dc3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59dc3d.TMP
Size 3KB
SHA256 be7668593ae0ab85f49a00c0fec1aba35dc6634b23ee852e380202a800b9867d
MD5 7e68fd7a8ab2ee7f1fe66e14a2359743
SHA1 da008744272691fe5c346bac27765f0da8714bee
SHA512 6505e18c55641f4b0caaed1cff65a2a7a14bb84a26a97a8fc26a36782ab44f2f5bf869f08e107210c98fb08c8ec3a64c16ba4a304ad9eacf3c92ab5766fabc0a
TLSH
T18E610B51D3EE09C2EB2ACDB6D8E19494B2F68C998C076A44715CAE7444FEF20D0D2F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 61f747c522186bdfc939b08fefc5ca08ce3fc8e61d2850d684a5c316d96235a9
MD5 10d11e36f808128585472e06a4fb4d04
SHA1 eac82b150f6e5dd396478a983714e5c1c855ca69
SHA512 609e81c4cacd9322a7fa4aa271a68cf33ab3f0b8bf6dca1e6cbd371be9de3d0dbc7e6523fda378d168dbcbe3bce7ffd143f6bca8d0fe732da5055c37bf1483ae
TLSH
T143519CF3C7E8856E890156F0AA187E1BCE2D0924832C7D5AC9E4EF1BA3E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e7aa3684-880f-4bfe-9a0f-bb1ff536d403.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e7aa3684-880f-4bfe-9a0f-bb1ff536d403.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cc3e31f5ccaf375dd51070c32d495289f390b2e56a2e061392a431e2c2f286d0
MD5 f8fcef29f93e00bff7a37c9bbe380feb
SHA1 8a4a58d2044111b359fe05a3e3da4b69f253128a
SHA512 af5a4ba2d8e8108ed2b5f9cc943acb4486be1cbe11aa85dc008da0f5e25049b9bcb984b5fb238690a3fa776d9c3d670c463810d4475a828d15e44fad55875b65
SSDEEP 192:sxRoR4Ca/fgsapDVdHm2Sm7aJ6zoD8pv+/yO6+WNIY3B8QGbIgVpJ:sxRoNa/fgsapDVd2aW/iIAeJ
TLSH
T1EF42BA1AAA289D3B8CC7D21ABA657F53D6F9503261D02E48A7FC8A0C04EB6DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8e613316e5235e2fd5580974e1fda21226a3fb81ee5b0e8819fea687c8399dd7
MD5 92a778ed10c596dc79218e47d597cc22
SHA1 d10113475d1ea90062e5aebfa6ed4071499d377c
SHA512 07cde01859cb5531f6fe7fad790dc4b8afcc2ad1ece36f0673d5e543ad8ffa8e79dfaaa120eb6349b47302b9b4836e3df34ac3456f22c255d8aa4e30771eec6d
SSDEEP 192:sxR/R4Ca/fgsO3pnVdbZ7wr26zoD8pv+/ye6+WNIY3HQGbIgDgpJ:sxR/Na/fgsO3pnVdVEW/CIEK
TLSH
T19B42B91A6968993B8CC7D21EBA557F53E6F95032A1902E48A7FC8B0C05EB6DD530740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f2787ee00db0d84c94963cb75f2f86f14c635ece50677e6cb02412ca4bfc3c77
MD5 deb1ff31598941dc6574cf48d23af923
SHA1 9d9c3c2ee99f8eee0ae3d27d8c405f2d1d1f0371
SHA512 6022e6eb2bdd64fcf75d46a5fe9c496ecc1795168533f1afab55e87c85a617058d91db4f8400139d350cf3e5de22819d4fc55f8cd473a9a2deca2742d69145cb
SSDEEP 192:sxR/R4Ca/fgsO3pDVdbZ7wr26zoD8pv+/yO6+WNIY3B8QGbIgD6pJ:sxR/Na/fgsO3pDVdVEW/iIAe8
TLSH
T1BF42B91A6968993B8CC7D21EBA657F53E6F95032A1D02E58A7FC8B0C04EB6DD530740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6dbe8a027ead76779ba5cb5c222ab426bf552ac61cf11feb0ae562bb3a87c548
MD5 d69e2c07adb52e5919a4a1ac577fb500
SHA1 fc29442d4d6c0a357a7c7fc12510b8c024b58dc4
SHA512 6e6176803be82a55a6b5e492db50afa4d1126bc969e7729dcbfdb3bc4c931a637424db409d22046b68dc97e6d9dd1d5f2c8d3f78d483fbafbac988d89cd42460
SSDEEP 768:GTEbKo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmMWc+ro2Zij:GTEbKUE7lkWg0CfKsu1japFcV2Aj
TLSH
T126C2EA7B740DCB7E4F804ADDA8197F9B6D6802CB9698CD4047FE851C02C6BFE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a72b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a72b1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 16e0d6e67bd548585454f18a3248001903c2cca24e20320a772ec75b7f21f1de
MD5 80ffa9ac0e0dda88affa45d35077b0a1
SHA1 9c966327770da3f2b310ca5c31f7a4373cc85521
SHA512 b8c48937dc1314e0395ecbd2d2df954b55d7ac6a8c311dff3a88771ba39a657bfc8e2f8ddb922a4f6e45494f04a130810bad1f3ae0c3668fdd6796bbb402d5c4
SSDEEP 768:Drv+4UNbdC3KCAc+wfZOcf6Mff6wwPvShCQRxb9MjS:Dbsb838wfffjfavSlb+u
TLSH
T19813CF31E8789A73CEF28655B2477B23BFE45167C5C80A48DADD4F0C42875AF171B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9accee199012b6b940d27f8014cbcbb495eaa4afe50fc985a5dafbc5936ba2e4
MD5 7bf48f917ba6fd659ad1a958a39a8c55
SHA1 edbf645ba2067ad4aed0ec54d66b70e838558da4
SHA512 f80c1f941b57f114ba4869ce05fdb145ba4199b7b8df761179c36866ffd89dab8045e820c3d65328115a96a9cedea4140e248d5d09b83b96181027f2f931cbf4
SSDEEP 768:qrv+4UNbdC3fQAc+wfZOcf6Mff6ww3vShCQRxpM:qbsb83lwfffjfQvSli
TLSH
T16F03BF31E8789A738EF39649B2077B13BFA45123C5C85A54CADD4F0C428769F271B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6de3f46a1265a37204a9d191f0632a6890859b60361567883bab138130e2fdda
MD5 3482ed3648581ca9c372864b826cd151
SHA1 37edea0a987d5c73ecda14fd34d389fabcd0238d
SHA512 7b1c33c31dd3a4e61d497a8b63e2b33fbc42d74d301c331c17f3eda7d641669473f0a3d91c269a4aea86e0870f9dc302f5eb366eb35013dc7e44b67c6ef9c5f8
SSDEEP 768:Rrv+4UNbd43qNPkc+wfZOcf6MgvShCQt22bwWV:RbsbO3g2wfffkvSa0wO
TLSH
T14F03CF36E86899339DE792487646BB637EB86173C8C54744DACD4B0D028369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccdce5de-67a5-49d7-88e8-6d1626a9ca6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccdce5de-67a5-49d7-88e8-6d1626a9ca6a.tmp
Size 45KB
SHA256 ff08996191cc72035aed6a59d5f72c75844d61212d08ac27a935884284717fcb
MD5 b67d9b0346765b8b3d45d746e29d03f2
SHA1 6f6690f87cbcdb17cbd80940f7d50794f046fda1
SHA512 da1c85e1585466b95dd1f6864c7630a4af9885339113532dd3edd20838c1cd0dde64baf3536a5f6f018d46a6820e4fe8c4079b8257c56f7a5b5ce0a07da569ed
SSDEEP 768:gFBrv+4UNbd33XwgyCUAtfZOcf6Mff6wwovShCQRxb9MjS:2bsbt3BfffjflvSlb+u
TLSH
T116239D36D868DA73DEF28B86B30A7A17BEE41163C5CC9994DAC95E4C01C75DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

d60753e8-eaf9-4b5e-a913-2d7a57b48dab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d60753e8-eaf9-4b5e-a913-2d7a57b48dab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2468_1533277532\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 abe1e61364e94267233d80109eb9b8df4bf93ee0dd799335d05f2454ed4cb913
MD5 fad7f61157b1de2fa8f9b637dc45e4df
SHA1 3d8b31d8f5fa53860248eee2f6734abecff784d6
SHA512 e6039ec17e93ceb2893ff59b6b8ba4c0d9b182a260ecfcafa50eaa5bbe21c2e4916827ffa6cb02201583b4196cc91ea1440b18e8315158a297e7c3a48fbcb8c2
SSDEEP 12288:747Q+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0Qyxknw4FYnshx8OfVe247
TLSH
T11865237CA7DDA892F86D11730676A231320AB5B49B70C1DBDB28B14EE4B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7d9b79ba712424b58fda9d4f59b3f2734b4e2614431e44af1990fcdd289fd778
MD5 783ae0e281e11420142813362c694f36
SHA1 90f047fc23cd0ce8be09eb8debe8ddbd3a97f7cf
SHA512 77f10eb16d061bf35fe25d78f9a36de9bcc8c6779b33195ca35c8fc63b63b6dc378cc0106c0917fef4a836e2a6e186155a8487f31f1607b2e9e9a9d4a4528f47
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYSyxknw4FYnshx8OfVe247:qgb4mBIBhGFyx4x8EVep
TLSH
T1E965AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 756c2d68b9b194159a5c56e602c404b5dd66cceb5787f1882dc34aca9699aa91
MD5 93cf36f1e1944a9c21a9927b94add788
SHA1 7d19c00702c40e22745f1b67ef816acd21ada88a
SHA512 1339dfa56cd63c4b798b3b0b6b308012a30655b6ed87ec9aab09d58208b50c706fa9030e3d395350a0070fc3414e618eb0f551abf8b9e6be7bc3379fff8b4e41
SSDEEP 24576:aG88u8FpJqH1Kzria7/mXyxknw4FYnshx8OfVe247:h7ZFPqVVa7/Fx4x8EVep
TLSH
T17395F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 97c03fd5389bccba829e02a8b5bb1842d6030a18c4c9471117e1e4f768f0fb9d
MD5 7b95d67f222f6b0008fc0f8ad6694caf
SHA1 b6ffaaa71bdc5ce66964168f9600965cabcedb07
SHA512 67f08d3606299d8a2c21e7658e41f03f92957635b84a2a9019164713466b993122e9acae3555866e27482648b29494cb306af850a72d8f35cc50fcb7ad1ea095
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+x4x8EVep:FG05lO43b3ix8EVy
TLSH
T13AD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d220e752649cc0b0e8172c6bc9771975f09e3b3315a097c1cd53d361709300f1
MD5 846f7d58a2cb925d6d09d183228494fd
SHA1 8e4bd3b0921d4f14b1c498deb260a98b3728a562
SHA512 262344d7d027baa4ac33d68831227dc209385f570f49fa0517c475338724af2d3aa77c1958ffde2eb75d3ce9eb652688cbf68e7d80a6dc362823fd85ac7632d9
SSDEEP 24576:Vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn1yxknw4FYnshx8OfVe247:1a5POZ3+Jt2pasx2+mmx4x8EVep
TLSH
T1F565AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d0444d22bc8d1a538e03d6aa16a09d972610540b9b226af2926299c0c2febf1c
MD5 7a8cee06e7799456e01e7d6721c00ecf
SHA1 e32d18ecc5e977a65dc20ccdbb590b7b7ef3c949
SHA512 1d97bd61c751b814eb14983218438957faf8646acd1ea0624bb35f2f0dda292d51b5ebaee2a9260a1f088e6ab0926c440de0834e6aed0aa00290615736be1a84
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7Fk/yxknw4FYnshx8OfVe247:ZNc/zEOVHFlx4x8EVep
TLSH
T16B857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 93b5930a863c83592b853ee34cd8d599bc074e16f7c03bf8a922f4aa5d5b98da
MD5 bea7f260f458b39db1a439a3b0c28214
SHA1 9b80fabb807e77659eb8c98acd1c3b788382df8e
SHA512 f04c0c626cb743bc59c74789bc283db89d2a68cb1a02144b8bb9f839f4b735a377bd5ce5cdf97f43828dd6c5d453ad7b98dd78f0cf1ed1173428cdf04933c31e
SSDEEP 24576:Q8kNvNnaFeYhJNtmZBm3yxknw4FYnshx8OfVe247:Q8MwBtOmCx4x8EVep
TLSH
T13355AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 68eed158d8fcc13bd90c364294bcc8a10c4a23967407e3784444c05da1f72e8d
MD5 32ad1e4cbfcc80603f0eba41183baed2
SHA1 6b7efe0b37b4176740569f6f354787997088c414
SHA512 93c8d0fd8e06cd6b4ad3d71028c30d8230159fe48c06278502ad082a56a1fb9119506b62637ca8716791509b5c25bb1173ee0e7b8bb28f3fa6b4819e7e2648e9
SSDEEP 12288:QHvUrBFrEjwaQr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QPUr+NQryxknw4FYnshx8OfVe247
TLSH
T18A75F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 624905f92416bdf7a0ffcb43b4d3ae995de8e2b9c7d4abb5a0d24dc31f188f43
MD5 709d5570f90a2ebe00b2a244d75ff3cc
SHA1 ff23c1b5a2fa502785f774e10197a2376ff8988c
SHA512 71031a44cbf13bc1f2e2d450023fef17240bfca37ac8e1320144eca0ab731f5da7f903c2144a99c6dcc1b2a85d82d9db6d714ea54aad87e094ea0e0e6ac34a33
SSDEEP 24576:WD3FHshBIYQgAsyxknw4FYnshx8OfVe247:WDVHeBIAAHx4x8EVep
TLSH
T1DC85E17DE79C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/8-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/8-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/8-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/8-557-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/8-559-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/464-76-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/464-84-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/464-78-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/464-279-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/828-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/828-162-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/828-172-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/828-170-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/828-168-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1144-184-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1144-178-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1144-177-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1144-496-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1348-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1348-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1348-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1348-21-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1348-13-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2720-6-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/2720-7-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/2720-1-0x0000000002480000-0x00000000024E6000-memory.dmp

Download

memory/2720-50-0x0000000000400000-0x00000000005C1000-memory.dmp

Download

memory/2720-0-0x0000000000400000-0x00000000005C1000-memory.dmp

Download

memory/2880-341-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2880-88-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2880-89-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/2880-94-0x0000000000690000-0x00000000006F6000-memory.dmp

Download

memory/3036-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3036-54-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3036-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3036-42-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3036-55-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4816-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4816-72-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4816-224-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/4816-65-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/5140-118-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5140-111-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-399-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5140-371-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5140-112-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5140-400-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5664-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5664-160-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5664-201-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5664-208-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5784-125-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5784-131-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5784-395-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5784-123-0x0000000140000000-0x000000014020A000-memory.dmp

Download