aa06b666694dba8b2162e184a5f3fd064974399b2469691f5bb312469ccddc94

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
Size 2.3MB
Sample260721-qqdweaxalg
SHA256 aa06b666694dba8b2162e184a5f3fd064974399b2469691f5bb312469ccddc94
MD5 7105722dcbc1b2f7db786d9264074687
SHA1 ae90d5f1a47f32c4647d1a8472785589f8d818aa
SHA512 2bdf0e74b4d33c272cfdc8f26d6c2db3c9848c78fb5aa78dcf3d835b31fe6ce6674c2c16fed0355956687bb15bcda34669e64d898d7f4d4b9bf6a5914f10dbad
SSDEEP 24576:vUkyFP1Ls7C2xc//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wZs7PMLNiXicJFFRGNzj3
TLSH
T127B5AD41618DCC22D46F003298686EBB55D9AC257BE015F7E2C43E29B7FB782EF31616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4228	elevation_service.exe
4192	elevation_service.exe
4440	maintenanceservice.exe
3228	OSE.EXE
4732	PerceptionSimulationService.exe
5652	perfhost.exe
3980	ReFsDedupSvc.exe
5684	SensorDataService.exe
5556	ssh-agent.exe
5824	AgentService.exe
4952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
1076	verclsid.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62b33f5e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	OSE.EXE

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_2110835771\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_2067970966\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4788_2067970966\protocols.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4476	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e483dca1419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291140977690570"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007622c8001519dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b1f321ca1419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b5cdd5c51419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000334298d41419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{32968708-9739-45B9-83FE-5290F624C155}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4228	elevation_service.exe
4228	elevation_service.exe
4228	elevation_service.exe
4228	elevation_service.exe
4228	elevation_service.exe
4228	elevation_service.exe
4228	elevation_service.exe
3228	OSE.EXE
3228	OSE.EXE
3228	OSE.EXE
3228	OSE.EXE
3228	OSE.EXE
3228	OSE.EXE
3228	OSE.EXE
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2696	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	5824	AgentService.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3980	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3980	ReFsDedupSvc.exe
Token: 33	4952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4952	SearchIndexer.exe
Token: SeDebugPrivilege	4228	elevation_service.exe
Token: SeDebugPrivilege	3228	OSE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4788	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2584	4952	SearchIndexer.exe	100
PID 2696 wrote to memory of 4788	2696	2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe	101
PID 4788 wrote to memory of 1976	4788	msedge.exe	102
PID 4788 wrote to memory of 4292	4788	msedge.exe	103
PID 4788 wrote to memory of 4476	4788	msedge.exe	104
PID 4788 wrote to memory of 4292	4788	msedge.exe	103
PID 4788 wrote to memory of 4292	4788	msedge.exe	103
PID 4788 wrote to memory of 1628	4788	msedge.exe	105
PID 4788 wrote to memory of 1628	4788	msedge.exe	105
PID 4788 wrote to memory of 4880	4788	msedge.exe	107
PID 4788 wrote to memory of 4880	4788	msedge.exe	107
PID 4788 wrote to memory of 1500	4788	msedge.exe	106
PID 4788 wrote to memory of 4880	4788	msedge.exe	107
PID 4788 wrote to memory of 1500	4788	msedge.exe	106
PID 4788 wrote to memory of 1500	4788	msedge.exe	106
PID 4788 wrote to memory of 5160	4788	msedge.exe	108
PID 4788 wrote to memory of 2672	4788	msedge.exe	109
PID 4788 wrote to memory of 5160	4788	msedge.exe	108
PID 4788 wrote to memory of 5160	4788	msedge.exe	108
PID 4788 wrote to memory of 2672	4788	msedge.exe	109
PID 4788 wrote to memory of 2672	4788	msedge.exe	109
PID 4788 wrote to memory of 5000	4788	msedge.exe	111
PID 4788 wrote to memory of 5000	4788	msedge.exe	111
PID 4952 wrote to memory of 2164	4952	SearchIndexer.exe	112
PID 4788 wrote to memory of 3392	4788	msedge.exe	113
PID 4788 wrote to memory of 808	4788	msedge.exe	114
PID 4788 wrote to memory of 3392	4788	msedge.exe	113
PID 4788 wrote to memory of 808	4788	msedge.exe	114
PID 4952 wrote to memory of 6056	4952	SearchIndexer.exe	115
PID 4952 wrote to memory of 2900	4952	SearchIndexer.exe	116
PID 4788 wrote to memory of 4112	4788	msedge.exe	119
PID 4788 wrote to memory of 3328	4788	msedge.exe	122
PID 4788 wrote to memory of 3328	4788	msedge.exe	122
PID 4788 wrote to memory of 692	4788	msedge.exe	123
PID 4788 wrote to memory of 692	4788	msedge.exe	123
PID 4788 wrote to memory of 4520	4788	msedge.exe	124
PID 4788 wrote to memory of 476	4788	msedge.exe	125
PID 4788 wrote to memory of 1072	4788	msedge.exe	126
PID 4788 wrote to memory of 3464	4788	msedge.exe	127
PID 4788 wrote to memory of 3464	4788	msedge.exe	127
PID 4788 wrote to memory of 4524	4788	msedge.exe	132
PID 4788 wrote to memory of 4524	4788	msedge.exe	132
PID 4788 wrote to memory of 3408	4788	msedge.exe	133
PID 4788 wrote to memory of 928	4788	msedge.exe	134
PID 4788 wrote to memory of 928	4788	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_7105722dcbc1b2f7db786d9264074687_amadey_elex_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://line.me/download
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffb6a96c188,0x7ffb6a96c194,0x7ffb6a96c1a0
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,881268994354166987,6494924797081025868,262144 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,14903825243983184066,1700488179636225176,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,8347777422642146927,11490615903400009818,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:13
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,18186010580099915455,13704923120327761968,2097152 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,1803742279524748964,5661319532111682334,2097152 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,17254294999953811681,14784280987095248961,2097152 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,11466383227245935420,5030065516450224967,2097152 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,7218249544314240664,14985317589835444255,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,16606726548241783862,2579899016595715824,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,1963119156342508010,12023495688416842226,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
    3⤵
    PID:808
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15086655123366268202,14155141883788534811,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15086655123366268202,14155141883788534811,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13756194844271567447,8945924008083957741,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,18101604224689447973,2773550135714588500,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,7788615410617631809,4095659165324910997,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,10598736490277032600,15648555379747760699,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,18124986869117650571,4080742456569150807,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,17767396699507496641,6526349667891317383,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,12153526509896888857,10045544065637237317,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5464,i,12969741680833279990,144801271500712587,262144 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,10850489436463715291,17461013508998650635,524288 --field-trial-handle=2460,i,1802112699468707330,5465025942520805956,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
    3⤵
    PID:928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4192

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5684

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5556

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2848 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2896 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5644

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d1b0a973c11dc36483f876a85482f8bd5ba35a97454e6ae7280c7b86ae45b40c
MD5 4b200f04209673bfc83d2fe23ef9685f
SHA1 acbb23b3ac1b722959fd0c73e05fff179cab5d1a
SHA512 b1edf1833037e03622c862464066c22db5f1f37ef4b3373bc815ef8ea7a225c00f76497be375956b32d3e7da757f32996ea433136f76bea8ea769bd5fa209f6a
SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnyLNiXicJFFRGNzj3:U3q6mjBx7wRGpj3
TLSH
T137D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 168841a6665445f0179dc9b37f5c71a8ce9ce4fd897f9b9820c5620f08eaa1d3
MD5 0cea6d97e08368703d2e661fae4ef94f
SHA1 4026ae25a8827055e1f81272578012968983dbed
SHA512 a2dd1a55fa12874dc327d1aa3ff0f8764ca296c56affddc4408b91c707fe8ab2bd6d4b2a659415f9ae3600b673cfcf766740dda790d964cda8faae0a13bec9fe
SSDEEP 24576:LXYfDtczAF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OtcwLNiXicJFFRGNzj3
TLSH
T10975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5f2b997793a33841132a486703231bd1a85d0e735fe5d3be3a725d37c5587111
MD5 200e20a5c499d704baf8b8832c794933
SHA1 dfa46f3364fea21b807d4df57aa0709785500624
SHA512 c5fd472230c11818856480f763513a45cf72c452a2248c439a8340520003e00ae8c4e7d40bff1a54e83c08b77996b1f499e81c801ebae7d5a7c141bfab6ac1fa
SSDEEP 24576:P0Le5ji0hmxhrM6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PPji0AzXLNiXicJFFRGNzj3
TLSH
T116859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b05628dd373e055a1af3ced8fc3647b454df0d77904a5e267c729e814ef38d3
MD5 4e0cf18149c128cdf1d0d4b0160f7744
SHA1 295568d15561d54d1f7aadeac3e67ee461adf8e1
SHA512 64dd7f833f1aa2406e25ad5d1f86986ddc238352d393d6299fb1f2d37fc1300a7734a82b49ce4e22d246ab20bb55685525f1579686cfcd3d924c534ce3a194de
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:o/ezSC6vUzPv+HjyLLNiXicJFFRGNzj3
TLSH
T1E9756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b6016b59c67327f1e3105838c0a87f92792811da164f5fd952a3fbfcf0dc13b0
MD5 fd6fed736615fb46b82c62909bc31080
SHA1 a6d8188af002368050420c6cfcba6c6514b57017
SHA512 d2fdd972213d89a9b0bb1cda55036bedbbf29177413300649bbf2058e2e342404953097b27e6c5cf02ab377ab752dd9897a509b2968dbbd2ef8b68d9b10c5209
SSDEEP 24576:lVbqPb88hv/l+BB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lVO88hXl+3LNiXicJFFRGNzj3
TLSH
T1F0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6895d265e80ac3b90fe110eb6b4e120b8d5be1ca66eb8f17c0a1436bc3bbff09
MD5 db16ff93db9461220d50ae39a375080e
SHA1 d60ed7a8f46c8b03c8241eaa8da867dbafd62d1e
SHA512 9e672c00c2483dc3d5ec9d9f41ffa92b399211fe614256dcc7a2340e184ea8a04b9793c11e23d6c7d7aed1cb6582d6ebfe2f721ee3ab54d455f1d0d56ac1d613
SSDEEP 24576:NGG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hLNiXicJFFRGNzj3
TLSH
T1DA5523D3468854B1FBFD003A867A5828B5845E2C8A695DE3D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 228797d6f46b09d8652e8900ac4161e0abb9ac55403ccefc4f33aaa3c54c178a
MD5 322f398529f3ac7edf0adbd818c8c3dd
SHA1 f54eed73267af4a9dac55902ae402ac78cfed53d
SHA512 53b81df6d004f2cf80be77995eb957960677a0466013e99c8d1406997bb2ae52fc1791c06c7daaa27882cf63ad9e90edc4610671da66af5466607a56acb344ce
SSDEEP 24576:sJIUp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJIUpLNiXicJFFRGNzj3
TLSH
T12275CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a4dfcf1c152532145a3b828b4ec0d974864deaccdf68b35c6524ebb344945151
MD5 0d198b1a86f0c92ab1514643efff9dc9
SHA1 300057fc0599171675763741a4dfdebf77df19a8
SHA512 b425f6a8e333f2bf22b5cdef245ccd8f8711cf2a0169a4e37fd4fc1e40e10712779688a7e63509871f3c00c5f6932c72a57b0064514fea5a55963f790b1e266f
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:aQvGAdlCEL8c/WRNw5CQ7wRGpj3
TLSH
T161266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 21c922af1a26611eb7cdd69b6432ab59e0f8e22e81d04f6e5be888668c19a534
MD5 859979390b04bcff7131075c353ffd2e
SHA1 018ea58e644eae437491e6abc6d1110f195a15d5
SHA512 5106ea8315d08162db79b22045e16a2614ca817ae3491e456e394aaadc583c5c1fdf570afa5b54aaf33b8cd451ed6d488ca7550be639e3fb12f16abb012a018a
SSDEEP 24576:3fewsAjn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vljnLNiXicJFFRGNzj3
TLSH
T1B375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0a98bf230165bafad8ab8dc89486404b60f129d29bab68478ce8febb90e8ff68
MD5 35e88caf6de50c92d29ded88bec2f5cc
SHA1 40ff39162b6bb9d5ae0f4d6a408bef97a448007b
SHA512 cd446f2921d699e81978651dd236a102be279316d27222bccce1b855f537add034effd84f2afdd1325a6e7c781914ed68ef3699c6171ca01eac82fab2fdd8907
SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHjF9:7UEtQevvqc2W1cpV20I32B9
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a11d5072fc57ca4fa778eb9155e252868ee8faed4de779002ba0c4ab8a61c290
MD5 52221aebca58ab9793808b3b616b8375
SHA1 cfdddf573db375adf7fa27a5fa04f363a05bd48c
SHA512 92728e945d87045c52f66ae3c59cebbacbfd1c049efc9d282f232d2263846179c4ff933fe88d0a700c060da66c59dc9cc98062a884abc8aa56828e4e3245a100
SSDEEP 49152:6CbRquA/m2yL5zLfFiV+XenmE3/zHLNiXicJFFRGNzj3:Poq2VjnmU7wRGpj3
TLSH
T16ED58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f65c943f7229401ae6d41830cb7e732d8c9cd3b6e208e11edd9e2e2c1f822270
MD5 18615333cd4d39ba7473f61e4d9a36e6
SHA1 8044bc8356529f225dc7b1884fa1ce3c5643b8b0
SHA512 11c3c89edafb083d771dec17a7ac4df09994eed18e173caf32760f0078c7458801a59a1cfd5736e7a6fd743a16f560a9d4f731508ad53402faa6ef7e092f9d3f
SSDEEP 24576:+AhGL6IFoiwtA5l7S530/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+AM5Foiq5kLNiXicJFFRGNzj3
TLSH
T161359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 88f09783c7595d40ad0cfaad2fc17d8b30aca24ab76418e5bc99b763087c302b
MD5 d2b6a483af9cf6cfd8b60c394633cccb
SHA1 593ef62c858ead155f0fd67bd661246e447cb9ea
SHA512 d0d021605855ccf2c7e35355fc259254cda2bffa6862a1af8004c0a22b5dbe639d294dda81e7da894b804a936e241a27880aec703f7c6eb4bc1aa3eaec92bc3f
SSDEEP 24576:mwuROWr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mwSOoLNiXicJFFRGNzj3
TLSH
T14F65F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7f9cf6f4ca631cd2fe127a51adfb52495c43a33e299e1c1f150d71bf1d98fadb
MD5 c4176fc210611a1406b29e0f4c359bc1
SHA1 bbf2ad5edb9c63e41865776bc64f893f5898f45f
SHA512 eebdc1d688cd8e27205b3375fda33cbd5ea6755a239b8a1fcb3790c41ea152b3fb263af0328f8e5d0532f280b005e873a33090191a7677915faff0259d24bb0d
SSDEEP 24576:6ZuC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T1A455129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d13357f107f9df3a6e86e8dbd181c40f2fc5a10ece814f62fe6ca25a5a59fc42
MD5 44ef708029a22b19727988abffe46742
SHA1 8e0356fa5491af7d451ed09383b505c80777c44b
SHA512 a52c38da0fd8be4486b7c2e92162874205b6f1189f33f5cd89c94d9143a3406eff469121c3c7dceb8a91965fdbbfa1b56fe04a626f1ce0266a75366e17ce8de8
SSDEEP 98304:aQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:RQyiKanX+PNhF9
TLSH
T137667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3ac2ce5f67d051cb6dc9877f0abf36a3bdbe098afe02dab9bc5a81381cd31faa
MD5 b917f9fa9b2191b23d297ecb854ab8ab
SHA1 08e93e04e7bceccab98fb14da49102c5eaa4cab6
SHA512 ca503cf860cb1ffb1af04db0374b28d7b47e14d99678efe0f86d24836888bae785313de2d58539fcaedd55706d94b6f6af50f4533c40c47f3ff30b1f7015e79c
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3t7wRGpj3:JQyiKanX+PNhF9
TLSH
T14C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cf1b11e46171096aeee52db9a061a8b5be0d6c2a005acbf4f0e71e5e22c812e4
MD5 01a920f0248511662836a1ac1c0a75ca
SHA1 2bef62929af14a9687f6b23068b3fe1ba4a33906
SHA512 dc816e468d55671d909d6b9105ec0809d0a40b26b1a0c6c4dc45862e1a301a60e67ff186cd14f40f2b3a70646b79e121d7410aa58b7a2375d28ab079bde31421
SSDEEP 49152:k68Qg55nhkeWu7PNU3/XLNiXicJFFRGNzj3:OthTRc/X7wRGpj3
TLSH
T179B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f21c55f41bbdb1b3735849284a3f28555d08bfab5c546bf5c4a8d4c310e7b121
MD5 3dbe22be9a6350f0166a0469d02b5363
SHA1 63b2885e344c246e3abaf41610c0d45379704976
SHA512 ada555be757c90c2fe71b842ec83e96fd496f1654c6b3952ad2f85887b21cc2620209a21b4d6098a08142c190d624170c5a0dc43bd82d4433d82da78a77e9610
SSDEEP 98304:my5112gYy5azzVvU69nLKnhZG7wRGpj3:XLIHRWhIF9
TLSH
T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aa8cf106009d46dc4ed0ddafc2e0ef8027ad46720cb4d8f9ed0c162647207fcc
MD5 eea9138e4a68cf0444a60d72db792b73
SHA1 e782bb2cf65a3e1def1bc30737bbee274a95ed53
SHA512 f613cbec3cc03b95533f44e32415e6bbc4b8d3ab7f9aa427ee01981f2bc6b24d5beb2e71b730a4cc7cec34296413dff8eaa33ad640c025814b9accef5295681e
SSDEEP 49152:nB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl1LNiXicJFFRGNzj3:pu6JmIxd2d17wRGpj3
TLSH
T1FAD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a211f428290b67d85de8cfc175722b8bb7f91e452d186232e648bb1b8e20099e
MD5 b3ad7128127722ff7b414fb5e5c30717
SHA1 95ed094cf8e2489c4601262c4314f07a3af617d3
SHA512 5f74a88c57cb527d1acd40fbaeda8ce97d80463b3d8df15b6cfec7704164c88cc80e6ff508db703dbaa2d1c565c82b5703efdc65ed8572fde912847db52b28ba
SSDEEP 49152:J1hpsNoJpF1A67U44CwH7R4xJLNiXicJFFRGNzj3:JmifPqRU7wRGpj3
TLSH
T1DAB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8c5925a51f3cd81ae5124a049691ae0999f0f4d990f469c7802fa454ccb84520
MD5 45c1d75618f5815afcaf8941dbbb319e
SHA1 77c146fb44ca7aacafa92414ca11dbd5eaba0cbf
SHA512 38343ff6c1642f27469dfd1617a269450c38c007da810e9c89ec8eb6d07c46ad142eba5fd4a4f005afb819ab74f3c470634c1473696c55744785d19f69d8d282
SSDEEP 49152:rSuZQIY0Be2KkRVtOnks6NMHqCLNiXicJFFRGNzj3:55dKqi61C7wRGpj3
TLSH
T1D6C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 55f95b3c51f1d54c180d8d87fb6c2e9ff4509d79c19432fd28cd25915d23a13b
MD5 30974172f398bcd62f130d2e75142e72
SHA1 d338c60eeeeab877cd450e4622047ae3a2c562d9
SHA512 a799de5e561e13a299146f84dceb2b5c3d32368d8c7d2e6a0232e6ef8555c1a5b494dc64fee5df051141f299a93d29d8277e3a32750cf2cf677705a5f665eb10
SSDEEP 49152:BhtSn8EApI0figjgiDn0AP5wFLNiXicJFFRGNzj3:QX2iWphI7wRGpj3
TLSH
T1AF95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9f9462564fa758998e7183fdc97a87ac33f40485d4bb7a5edb1ee90335aa4592
MD5 c9273df20f467cb6b3b0bbaa115e94f3
SHA1 2b3753439886567944fa52bb5eb49e2d0279bacd
SHA512 15ba957c3b60cb23893d571c78eb200407ad6c3e06961d9efd16d1efd9d2329b94ca8ec916c4f69ba257ae798f9c19ba94d7f3abccc617ebff9debf3021a2abd
SSDEEP 12288:KkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ku/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1585523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d9134d49897c0aa3964cc6ef0010de99f3607f266e7338394e9e1e8c3694f57d
MD5 b24485d5be1d097d32534fa964ec4eaa
SHA1 4b4d4de40c4d847f32b54e338910faab6134203c
SHA512 08cb150815a6deb46f027bdd49f649dc2a71bbc5ab998731ac5233c62af4a0e38b4f67f1c3979a81278c7b14d4baa2474078e9ff8a20876978e738a66d69e542
SSDEEP 12288:VXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Vj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D25523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 5946c07265120eba97be78827a0cdb7f53c9eaf25742114dfa9dc3bc75efe39e
MD5 bdfa30d174c33244929332e04075bcb5
SHA1 f6b7e55d097487244e6141841f15fe1ff8b1e8c0
SHA512 a60d301c4c4adaf12ace597c17fb1aca92408004ad6ddcd893c648c59ec08a75b30dab5e80399205d220454d0c53901a578a1af68ba44d0dce51ed4924792742
SSDEEP 12288:6tiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1cac9ea0b343143e696e3d797adda24b978148df0cfa2c9a0c4417c12a79feec
MD5 214557110229a06e1b3e55d5d835f805
SHA1 a0c24cc00fe6426e13deb2929ff07d66edc820fe
SHA512 1257a5155f95d3910fc41be9569ddb9a842df713b65b397a099a8407bdb5028f72b4cfa419cf46f643c851b730f06406c32a597d2d6121a34c07c9191f5fa56f
SSDEEP 12288:5VyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F552393168901E1E9F98039CA764424F2947D6CDB325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 090696b599d945ae3b3b85efa6b337c63c41d9d9fdcdba99eddcb0f0a92d5042
MD5 400a2466288b4954306495002cccb9e2
SHA1 3b2ff7706ca812412463284b6fca298d01fadc29
SHA512 811b313d3b7805042f263a97ce0d3640cf965f5ed31cee344c15e00d156bf128e9b898512ae6b7dde9fd806114c062f0d7385b8c16adcb3ee268ce4a13a449a6
SSDEEP 12288:IqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Is/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1025523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 368f797d256aa388a7ae01c8f202bc82303e99e8c1db7c01e48aa44cbcf44021
MD5 613012dcf7d328ad58997c06cf9a88e9
SHA1 57358da4870e6f0d48b3bdde8a4cf939abdfd4fc
SHA512 1b5ac9630e505dbefe19595950e7acf79afc4816a410e01f91b6d3a1e90cf201e9a0f30c2c993061b95fefd36bbab5444a653f296e4172619d13b6eb5eb6db7a
SSDEEP 12288:MbiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3558955B1FABC0039C6754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 52498d4458bf925a93a17fa7d5c06fcf22c89092c1b8af7bc36efd2a3155b7ae
MD5 cfa9bbab2d1fb40840c68475ac09d76a
SHA1 507c2069f9573ae5266c93efaf0de79eccca3b20
SHA512 097a77265f530809f6e1c8b8e1b032af1954a8e7e8fed4c9e2a9db766e60c4346c22ca33796cb53858b8746c38a5a0fb356120582ff1f54d361343b25a51a8ac
SSDEEP 12288:rviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CE5523D3558955B1FAFC003986754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3f1c9150a63fa789df0bb8b19985460f08f2dc11f261b8de677fa9c93b3440be
MD5 866b7da15037f35a27da4b4fd81bd80e
SHA1 66fd0c334f4f19ddebd7e1771e9ce49488387dbb
SHA512 8eab39fc3bd2f063a5d6dbff13123bc3b7de1a963b6a3cdd0f6d29f690920ff26d4723f8596b7aae8a81eae5c70200e97692e157e0233ff91eb62a9465e7bc3c
SSDEEP 24576:gZM3zFVSOD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gZM3zffLNiXicJFFRGNzj3
TLSH
T1F6750295B39018F4ECB7813EC9258815E6B27C1A4B70C65F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7314ba623d0dbf26169f7509ab51918821e0db236ee8554649569ac730390d12
MD5 c0bee03f3deefdf61f0e84bd13797541
SHA1 320389627b2a9477fd3db35fad62629fbaa35603
SHA512 beeeda21e626eceea681fd9f6ad9593c7184764772232fcc9868575287cddffbe586c104826ad06c1cc9a023b2754eb9b31af64e101f6369699a17ad9afe06df
SSDEEP 12288:lAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1635523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2083D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4e4017e33d489a1ad56943a9705bc19de7a661104e492d8c85d6660e6e7dd393
MD5 ee857663f6da5a05e8560f0440148ec7
SHA1 056607e022004aef485df6b98c85f303a0933e09
SHA512 354c8d55679a93c6226d8f56e622db08f308515522fd05912819bf9900ef4f0d8fc7291c9934928d80708f93ee711f956911e08da901508e9e0789523a30c37e
SSDEEP 12288:esiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:eW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19A5523D3558955B1FABC003D86754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5619ea6904f3aa4c82d17eaf70d5efd05507ad43f2ce5ecc656fbf1caaa0c67e
MD5 6063efdca574ff6f9e4d3433c1414694
SHA1 1186b635add3f5b55cff1419b868a329cbe691d1
SHA512 ae0e0e3e1b962f8d685ec1e230777856d607ac528cfbebd0fb6bb21c445f4eff4c1ab9e0122f0825bad3ccfc5fe0e29be0bae0edf7e2329f5e8c8097e01bf7ca
SSDEEP 24576:fzy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fILNiXicJFFRGNzj3
TLSH
T166650257629530F9E17A8139C9620911F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 61bf9435fab1fa162300b238fceae9e685c98ba60fa0e224ef8783780db4c9d3
MD5 ae95f19a2cc77eb51ef9a235f852f98f
SHA1 12cbac8ff1a258f6c5304b9c209093ed0f490feb
SHA512 f97e7b677d32c234c2dfb6f30f0551556507bd839294258ecdd456de0b92da15b96978630bbc67da541bc63571e75eabd6d0828b59dc8e39d03fd81c1bebb717
SSDEEP 12288:sAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1FAFC003DC6754428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 838559f39d3f89e01f54b6da6309ab1a6d393cd8a53606bf50aa479be711eafe
MD5 fb8365a767fbf913190fef96bace7922
SHA1 237be70d49272fbb39856c04a9a241c5feefeb07
SHA512 9d81d580bf1cd1429bc844fa4bfc186cfd27bd3df494b932fff11290d2f46476f758315b15d04e43458b7a663905e8662dafa75c009bc444a1bccf3d71b74df6
SSDEEP 12288:2AiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2083D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9541440947b85c164b12ce371da17a7842e434400e4f707797948526f8151c46
MD5 0694c4c297efdf194819960435253e3e
SHA1 dfdbb16f8f6b2303f23780dda35e22ae6bdff1aa
SHA512 903fb80bc222ab69650bb4865a4d79462815c74206a4c4f1e44a9b06daf6f58a264cbc1397754dd94ba7e38e84abde2400ddc4ac83ad5ab52790a291d757865a
SSDEEP 24576:Ozy3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:OILNiXicJFFRGNzj3
TLSH
T1B9650257629530F9E17A8139C9620911F3717C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3b0fed6f1447f1e0a3df5727c3cd4c5a72bc1aef3ddf60ebb116fafd13039755
MD5 4758cfd9ca30896444866b55398ccb84
SHA1 7f47cc1b65921cea8b51f4fb55747b6eb5be41fb
SHA512 c0ba5ddfafab6d82bdfbf66b298c25ecdb63928f82a68711aa34b5400d5e01f586d3e63fed691d42cf30c7ec8ce78e4240ed4634cd005f3f6ae18ae530d72cc5
SSDEEP 24576:dT8aLl3z0zDh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dT7LljALNiXicJFFRGNzj3
TLSH
T1467502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 04c9b2728080093419711e23d2cc5e4cd6142bb17d5e3260cbe46ad4fcc44fb6
MD5 067bc392cf37358c8c5afb9e8a0622dc
SHA1 fe8e1750057a2f24d91decf80e77b25441c2812f
SHA512 f453afc2d4659ca9851fbf1b3d2ca41b2b0994a006107df5937222941996cafc2e678ec401d5cd05162669cc8a9a6fe06bf55fe519f54ddd4de14700b5d4270a
SSDEEP 24576:c3rd9CHKy7GZN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Grd9CHKyafLNiXicJFFRGNzj3
TLSH
T1EF85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4552f85b94e161a030b4b46f28a936554a629372508723216d6d4cad3ba786b7
MD5 990d4a8fb58dfdd8f56bd9664069e796
SHA1 77c85c148ce2a83900deaa5b09a07632c6786c22
SHA512 28b46fb79c8f4519900ea7d58ba068045638762acd06401baeb54ab8c305c73d2e4878b74242e06aee9c58b0c1061cc1b1b8d91569238bbf231b2d44f9d24b79
SSDEEP 12288:5NiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8d5e50ec09719bc5944f2fccdcee8c33ae08b83b8c485cbecbb77135fcf9563d
MD5 e259c6adde2aeda9f46e7c452cfe549c
SHA1 56b8d4c8a0c04afa77ac0f5ce2cb2425772fa10d
SHA512 39755216ed21ca2a8fc723eabf8544fa1eaea14a338e247a2ece493ad336c7e6efdedde92000da745ce824080df86280cbf9eecd60d1eed5e0e48546ac6f0781
SSDEEP 12288:AjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1935523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 434ecc3dff98f99edb4e9472ef3b241d46e7bf4de2f9adc7b8fd5d761f7a6c84
MD5 7cb13640e6cd70b790248bc98beb6c8a
SHA1 4c3f9f9821f5e0b62015b71f79e7d69270622238
SHA512 127bf78ff61263a6b0d80b69ff0e61db4b02a0d94f4ba2ede3707c3c965467b3ec129ce0ac360c6a530992d35c001c5deae91c324b8a24c5efc1be3ccec97376
SSDEEP 24576:Jfwvzk9RX6wkyAIm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oMnYImLNiXicJFFRGNzj3
TLSH
T16A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 de044cc53a33aa406419d808fbd0cc03d8200875cc7ffeee284e1b6275a0101a
MD5 9d46765c66a825d59ebb366e7464c614
SHA1 6945597bdc5205f1fe133bdaabd64a29567000a1
SHA512 2c45d99b18bcc7c525806044024ab80c8bd3cefa13a1c83f87d08b6c220162d11abb81585ccd617ceded3eacfa9c5c690ccffd2f9034b31aa14ee4ff6c7d5440
SSDEEP 49152:cYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lLNiXicJFFRGN:TySzPN7wRGpj3
TLSH
T11C066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 49b316dbb4fe3f1291c60be4d65b97051f47becf4b3540d3e5cf467092f90674
MD5 6571c42030c57f19cc4ff64b1c580cce
SHA1 669288997d22fae6f7c3b330c7d7d614c1ffeff2
SHA512 bc379659ff7428441520775d9d55e26bae8c0676f638ef9ceaedd83c5fa7d92879c98c1287840a75fc8c8ad35b28ba0b1f40e296ddb3311246b00d86d26f98c2
SSDEEP 24576:S47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S47JUQjqirIhCnDHUPfF/1LNiXicJFFS
TLSH
T1F165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 8ed698f0448d041ac4035aeee0b104480cede3d6ff33a35bf07c2c03888a85ab
MD5 12c77708d1c2200142483fa1ff30e2ed
SHA1 7b7070dfd91004be4e7859dcd3d5cc28b82ceb17
SHA512 eed48490916041777e24403f42b333cee219679cb133ce5a802481f0059bad6fb617eabb16b9a97e594ec538a89a981ee6b38f67c3f12873af23e5bfd1f2e9c7
SSDEEP 12288:dpsfQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14965F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 900KB
SHA256 dcbccff92b41376a8733935e433396844f7c3b70b5b107729c8697201e7b4bce
MD5 84c2dd5f5c7f2602da3a2c49fa9e8883
SHA1 030f34190282d37d8d2eebd75b51e63fbac0c9cd
SHA512 fe9a5468dffece9c037895733568ae869f75b18e000cd95efa06c27754a554546ca9d1f7008ab8cb3719ac5b8bf2c30f91415d538b297384e13310b78db170e6
SSDEEP 6144:MTsBC2na2+Wf9DCnUAESi2CotMxRWhOU3ftkso7cv1p1CjNIfKljQrF5zhSXj1yP:MMzY+LU3ftYC1pstljcdSTEivkVvsdj
TLSH
T14D152710766BD75FC6A944321E33C2CCAB70BD41EE059B0372C9872FC576669BAF2192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 342KB
SHA256 2958821b88f506e3912c9df55478771f33499bade02068808d1b60b7d538a2dc
MD5 2e742ef039a3f37f9bf78ad5a5f24011
SHA1 86b469e8c634021fe9a8be3ec51ea984cbff958d
SHA512 31db5963495ac7cd25dc9c556a437d9406a8bac35ef60247d75ba61ac316eb8b3a12aa44c30738b9c23624b02b8ed5c448db8fd295a15f0bf624b8f5c032dc13
SSDEEP 768:Ch/TFslToOlTPBlTz2+EQMHhIh/TEAslToOlTPBlTz2+EQMeOslToOlTPBlTz2+r:KyhrFGcbr6VpksfFf950rwR
TLSH
T16F748411B754F22AC4B641734871D69BDB3DF813CF1252023BD91E89D8B329B7276BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2c766e1dca18d7552fa9b72abf4827909b791f521dcb59774093d6a5834bc54b
MD5 179d0f0a093b58479849285b3af2e299
SHA1 ad33a636a72de5f9b4033d217c7d32bfd812860e
SHA512 8b35eaaaa988213937b27905c8180a6c27bc6534830d25938cedab8dbd01fb513bcbdce83a4099b4cda1539442ee1b19b672145990796e14b5784fd1532cb385
TLSH
T1B6516261536209C2E7BE0EB2E7E1944B7EF5A4DA0A47BE17C0D06E7488E6F141DD90E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b869.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b869.TMP
Size 2KB
SHA256 ed53d7896aa94ee66e61f6a9496b0ceef644a3503adaa93ec8dee1bb7bf6dfbd
MD5 b7613cf5554360cf1ba9696a55a58dbc
SHA1 0f29758cca5b97112efef65fad5b5b158e1b4ef3
SHA512 ddd9753eddc1076b5f279fbc2a98941b3fa851184913f1ccc64d914966d4f4d285162f24a427a1a303f3d6e96aacd3c6dfb09155cff572b585ab3445e6a7914f
TLSH
T122517661536209C2E7BE0EB2F7E1544B7EF5A4DA064BBE03C0D06E7488E6F051DD90A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c801887e4bd3541fa4b4f29791013ac04d13f1a8d7fb4c6f16d1b0fe7f84e380
MD5 c3840ddbfb4206b287d731518a8598b9
SHA1 95c878789d567413c9b9f3dd56fbba32dba031d3
SHA512 ab1f81b37da23b91551a18a2d039112d332c1e5cc21ca2a306eea9741753b1dedca7c06cbd5fb48398d34ec142eef66eacd5c40d9073922cd3905950b9df110f
TLSH
T1CD21CDF7C3E8A67D890182F866183F1BCE2D0854832C3D5BC4D4AB5B93E1471E240A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 3283e2a0dc3dcd4dacdce791c0f79bd8363000696f6a275fd6705c56e379d8bc
MD5 4ec8f0d13d40623043568a7f0e70b6fe
SHA1 a4b4e4f10c311b1f009a2499822c82a4ea564947
SHA512 2d3288d3f974c2554366dcf4a60a77d7a5e234117ae907fb2367e3bf1d8aa2c7f357c87d3c711fe6709ca9fb245881e3db7b13c9e0c74efba1ca28a427c7acb4
SSDEEP 48:YALlNxOC7uLC7ubgyqzAsJbRsJgfo7CZsjQzsdzEsuCKsyCabs7CVsUpC6C/giCj:DzOjjEp5anLzCpfOSpDigiRQ1CHxwJ
TLSH
T1AC81ADF3C7E4866D890196F0AA146F1FCE1D095A436C3D5AC9E4AE1B93F24B1E24194F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c40c52f8b5b49e89687ea59a395622d852ed35f797032e747d37a183e2f9f70b
MD5 a84a3f632a4b3217737ae4ff8928db88
SHA1 91a52fa8a111782770e803982f01be8dec763aad
SHA512 7687019b08fc2a1eb1ee17b838bbb055b78a5e879e8d8b6fb5dd86cda6759361378d5052b3b9d3f58392bd7ffaf20b8e573c68a728a6a5acc19b980bae138c4b
SSDEEP 192:sxR7RMCo/fcsFwOZTYP3IzoA8pgY/g6+WNN1y/P4DnfFhyGNIgDlXJ:sxR7Jo/fcsFwokh5/5S/SH3P
TLSH
T12742DA1AA928593B5CC7D21AFB56BF13E2F91036A1D01E44E7FCCA0C15E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 62c3fd13b1cea40fa96989d6174614c806a8cff887e5ad4d5f52fb071f780a9e
MD5 5cd782a7dfbcdbcc232010bfa011b2ae
SHA1 eac14f5d399f345afa9012a5c8c6fc7be971d774
SHA512 34dfbd365de436f38548203a24f552e40b9e005016673973d60c5f4899365ffea9eb9c75d5d09a9119cae710a2ae660eb054872eda8864460bdef1d2ed10209f
SSDEEP 192:sxR7RMCo/fcsFGprQ5ezoA8pgY/g6+WNN1y/P4DnfehyGNIgDn7J:sxR7Jo/fcsFGa5/5S/Sk3J
TLSH
T15842B85AAA68993B5CC7D21EFB56BF53E2F91036A1D01E44A7FC8B0C10E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 486e4115d7ed04498c591e42aeb5f7facd9dce33d6f470fcd72c5de450d20f0d
MD5 885fd7c9ebc91076d2257f3e0c30f593
SHA1 ee42732d7dbaba1967f07744f6e43c11036c2fba
SHA512 871d0a5a9ac65e080bf76987521e6d6e0355be8206c7f74c6945f455898742221e5ba6ead74c6a4670cb7a15c032ee3f0fb4d7520dfe2d22b274525a1b5def6e
SSDEEP 192:sxRERMCo/fcsCGprQ5xzoA8pi/g6+WNIYnY3hyGNIgV7J:sxREJo/fcsCGBi/5I5R3r
TLSH
T18632B8166E68A83B5CC7D21DBB56BF53E2F95032A1D05E48E6FC8A0C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e9bf0b752905003fd7acd2837964ee75ea23e0506335f141d9a258e857aec0e1
MD5 629dd9d96fd4e9ab19ea8e90f9cb822d
SHA1 30c03439559733b85fe85330058dbe909ef8fb29
SHA512 6a896d6ece0e75e327a86627333f465a8b7c3e3b603b6bf07b54c2ddabf2f98e1d3f4ca109291493295b963702ef6e70db2936241338d921698b5b3ac16289c3
SSDEEP 768:wb8dRg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnu46Nrohh155:wb8dRsE7r6Wgouf6Mu1ja0V6mxv
TLSH
T1ECC2DA7B740CCF7E4F800ADDA819BE9F6D6802CB9AD8CD4447FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ef86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ef86.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2e8ebe1bb9de9b911ee6cbee148a6d534440f718c5024f9d31ac8f799fc8893d
MD5 08e11da85df787c4a67507e338f90544
SHA1 46d2d329fa3edce7ac5104a7f08228956f620c93
SHA512 1a92aae31774dd79b244da6950a9401465974b360520597a15d073e4c5d5a79d4cab630bfe15f7bfd5f17239150b6d8ee9a285cffc4baae728a4424516efab83
SSDEEP 768:+j+9x3tPvdtDZIO0BaKKNzc4ReyIsP+b9Mw:99x3tNUaRtc44bsWb+w
TLSH
T1E2F2BF35BC2A8EB3ACE69246F2473B967EF4516BC1C81E94D5DD9F0C0A872AC075B413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 82bde9b4dff1070588b6f38828541c11f542a94ae16b21f5eaea1e12491bec14
MD5 1bbab9d17060469fec61abe4379df7ff
SHA1 1137cff97e0fb5d6b82d89606a4387e28d0f29be
SHA512 5c5a6baebac6b56eb20ce5e34c60d8d5799757518115d7a53a893738f526828db3dd7c3939ec23d6b0645306ae1f235e6468acde29680f41089c92c15d368491
SSDEEP 768:zrv+4UNbdv3+PVdtDZIO0BaKINzc4ReyIsP+BY2:zbsbV3+7Ua1tc44bsWBV
TLSH
T1FF03BE32B8298D73ACFAA246F1473A937EF8106B81C81E94D9D95F4C4A4B1DD175F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a2c430a0e91e016febc4ce582c2ce3908554f354cc7320182b756cd6b97570c
MD5 50b03da50913b416b7693d431a09a490
SHA1 0a4f0c295c4788c8afb3023977d298328d96f8f3
SHA512 fceed98e61bf219708fde1a850f64c183a69ccafb499137594960dcf1a2a864f9515f5293b95fd71322fd66ee3e3e6a3da1a67ac53b683c24adf0f3b85d5ed0c
SSDEEP 768:6rv+4UNbds3dMTDZIO0BaHNzc4ReyIsXzeVH1S5D:6bsbS3mWaHtc44bsDEH1Y
TLSH
T14103DF32E8788977ACF6A686B54776533EF8912BC2D81A90C5DE1F4C464B1ED130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c9693bac9b07d26695dc08714c8ee67f535e810ddd6fd001e5a97818a36ad378
MD5 ee3b81a236ed5ad475f7224ad8a4bd83
SHA1 2bd4a7a3fda2b831857834f752cca1a14570cd3f
SHA512 9bc8674d6826fe5c70159af9e4a923a42067f8a51077235cea1858bb4def887a1235fa49d36c0641cfcacc1d8ff5226fbe34d7904bb7f79904db93c3c92e9c3b
SSDEEP 768:qrv+4UNbdv3KPVdtDZIO0BaK/Nzc4ReyIsP+BY2:qbsbV3K7Ua+tc44bsWBV
TLSH
T16003BE32B8298D73ACFAA146F1073A937EF8106B81C81E94D9DA5F4C4A4B1ED175F913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 16be9718bb45b5837d39d44ec962d45cbc08aad372d190c51d1ef023a31cadf2
MD5 57d5a21b609f000bb2b312b32a490c84
SHA1 9ab7eb091b82d238dc77e32baa2fbe2e1ddd12ce
SHA512 6b9918a89b02d72811ae077c713e2e95667238ee3e88de912ea8830c2ee84f53cf45153d1b5483098bb31b7ffffc4e46c109ffe4c7b80b1973f064628ae6d31b
SSDEEP 768:qF4j+9u3ywgSPvd0ZQ5O0BaKKNzc4ReyIsP+b9Mw:+9u33N5aFtc44bsWb+w
TLSH
T1B2038D36E865CE77BCE64786F7063A96BEF0106BC1CC6DD4DAD99E4C01872ED034A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

333d63ec-ca75-4d14-9ad1-c396fa0bde0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\333d63ec-ca75-4d14-9ad1-c396fa0bde0c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4788_1228902968\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 11078f272162a50efa0a2673bd9603a13dc6c08a5ba89833e7d78c643c2bdbfc
MD5 689af8554bbb273c14b75fdad341ae9e
SHA1 f05a99a6c8ade2c3422aed4868490c9486e216b2
SHA512 3c9e4d48dd4da4638d39ca8e71499fa5ce65e688d234f8c57838d4a855d38af1f2e557942251954ada1e73c0b7987fd32c601aa05fea8fe2a45aad0eb20c9474
SSDEEP 12288:uF7oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523A3468D59B1FAFD1039857A8434B5487E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c3bac00e18092a1a0b9f9bb07281d2d3e1f77fa55767d8ad92d435cd1dd01654
MD5 204a8988d3c98ac0319cbe8f17162f63
SHA1 aaba98c68c6f593b92819b9cf4423c01bc3d35ad
SHA512 4109e7d4ce07798148f753c30dbb1c551500ef399bf4b3eaeea2a6a0e36a3732bb674be36c3adee5355baf46c3f0add7754611cd29fc48330382c30c4083fe56
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0gb4mBIBhGFTLNiXicJFFRGNzj3
TLSH
T17265AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 53658714a737a695bf8f09331aa6beb2a8af06546b049193c6bb154a0cf4e250
MD5 c61640169ace27f3e7c0ea3b6e450639
SHA1 ae9d84cc1279143689111ab8926aa1f58cd6388f
SHA512 15a38385d218d319b3442a366b82b1afd0685852e298bb7d815a88f697548752c5c111255865848dee33e101d7aed2e7dac43008035e430d82fbbfcd7e9d1385
SSDEEP 24576:dG88u8FpJqH1vzria7/mD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w7ZFPqVya7/4LNiXicJFFRGNzj3
TLSH
T10885F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a128a775e0d0b5d2eac23bc0bae41133f8a21f1f578361d6a5f07657cff8e916
MD5 e7432e3549d950d954abefd11e63588a
SHA1 919a7573aec5e36e7053f787c023be982c66e49f
SHA512 37a85f606775557f4625edd7ec1848e4126f974e29daa9d59414b0addf542b40997bc52882ae371c6797da4823bdb602a8ca1dc00434a6bbd69f97677b5a66eb
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPLNiXicJFFRGNzj3:9G05lO43b+7wRGpj3
TLSH
T164D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d4920c1bcb3a06fff0a35d76f93cf36670bc1c4ff748ab20ddc660cc27f637cf
MD5 2197b06e6d84656bd974e39cfd387e9c
SHA1 ff50b26549b103ff66a7d30599f8f43f93848025
SHA512 edb6daad73f1baa131b9f6f865bedd87b2d9afa19931c74f5b47d1b428850c03c7131289fae355dc529144daba6ec3d2d5ccb3cba7ff2b78d0522d2966168bc0
SSDEEP 24576:qfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnl/TwSfVcYG3K/cJHlnFR+IGNe8jg:ia5POZ3lJt2pasx2+mXLNiXicJFFRGNf
TLSH
T13C65BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 639c44b9ef226ca7cecc0438eada0f58fe9d914e202799a8b4b8752bb60317e0
MD5 467e5d832e7ecce4ded1247ee206a8fa
SHA1 21866feb5dab852c7d945d3ed94e46707b8717de
SHA512 9111b04b50d7a03844f207f749df161bd80f9c0ccdc82985b240d685e791eca99b1f8424e1407f861ce3b8f3c65b6abe2ab5e199fc71e8cd62b4638135fbd2cb
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lNc/zEOVHFYLNiXicJFFRGNzj3
TLSH
T1BF858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1f0f9def94ffb885b8645d2ecaee20977e0d56883022e9bc1bba67b55cd5f8cd
MD5 af826325bc27c4a366a81969bd1b71f2
SHA1 9d56175aab4d32f9b8e49fbdd96ec0825cd09f99
SHA512 38307939cf2b43bb5409dea5a6a0c51c9ec944b9262967ec9e43e475958aad950178481e09cf12e4ff83c451321daa84dd86bf4944be40531dd0ad60e2aaa336
SSDEEP 24576:8zkNvNnaFeYhJNtmZBm5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8zMwBtOm5LNiXicJFFRGNzj3
TLSH
T17955AF6EA6E806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 2d89e10b1dc3c2f500348b2a6800984590f7e9f16c6c832a091148bd5c551f6a
MD5 9394749058ee6dd4922f90049c8efb22
SHA1 0ff3483b7f7ba82d951a2687749fbd75b6e64aa1
SHA512 9dca2cbb627916db588d62e17b2742d7c1c9f5181300b9131250425fd8c8d0379448605b9e62bdab6e9ec288caa4d307dc1c7bdab9e2eedbd5b7fa088af6a5e6
SSDEEP 24576:WPUr+NQf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WJQfLNiXicJFFRGNzj3
TLSH
T1BB65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9095cab825a28129a507c824184c93e9af00d1b4de6f6db02491f58abb32a9ea
MD5 b4f4708d6471245ceaddd293461d2038
SHA1 0ae8a0b1ef95f127d1cf011f65ffeda847000383
SHA512 25d507645098f524cb7c5cd6ebe5621fbb5e0ecc2232060451609148209911c61aab3805e22c9ead95ae116cf028775045737e6d65ae16b1b331c80039e7de6a
SSDEEP 24576:wD3FHshBIYQgAO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wDVHeBIAAOLNiXicJFFRGNzj3
TLSH
T1B575E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2696-77-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/2696-358-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/2696-1-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/2696-0-0x0000000000400000-0x0000000000647000-memory.dmp

Download

memory/2696-7-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/2696-6-0x0000000002310000-0x0000000002376000-memory.dmp

Download

memory/2900-903-0x00000216A9260000-0x00000216A92DC000-memory.dmp

Download

memory/3228-51-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3228-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3228-261-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3228-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3980-776-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3980-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3980-766-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3980-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3980-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3980-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4192-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4192-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4192-362-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4192-355-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4192-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4192-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4228-14-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4228-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4228-20-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4228-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4228-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4440-60-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4440-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4440-46-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4440-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4440-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-73-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4732-67-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4732-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4732-285-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4952-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4952-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4952-460-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4952-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5556-372-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5556-122-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5556-114-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5652-84-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/5652-295-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5652-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/5652-79-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/5684-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-381-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-108-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5684-102-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5684-354-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-373-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5824-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5824-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5824-138-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5824-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5824-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download