b78ea40a3e045a727041ff7fc33ea2a092deb98d529bf4f845943c7df2a7ec36

Analysis

max time kernel
106s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Size 17.9MB
Sample260629-dv86wsds6j
SHA256 b78ea40a3e045a727041ff7fc33ea2a092deb98d529bf4f845943c7df2a7ec36
MD5 bf184e3ddfbac7d8c93a94a004e4d965
SHA1 c0839d2be5ea8a4d162cc29721fe6ede60be670f
SHA512 e2c9d5bbbf8720d6bcdc3f26bdb1b66e41512cb5352fce859f7f84963d1da67ed1277a5e33b9195aa8601c35b5f5fdeadadbf84041ee73abd67743ec02ddbd32
SSDEEP 98304:YBvuUWSqAIC0ML7cakLYmWS1dbOE/XERpcb4MCO4sZZg0AudCPd1U023W:YBPeC0MLGLYmWSXmRjMf4s/gmCV1p4W
TLSH
T136173B47E8A145E9C0EDD534CA62D222BB70BC485F7427D32FA0FA282F72BD06679754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
4988	elevation_service.exe
4700	elevation_service.exe
3664	maintenanceservice.exe
2856	OSE.EXE
1952	PerceptionSimulationService.exe
1780	perfhost.exe
3148	ReFsDedupSvc.exe
4352	SensorDataService.exe
3360	ssh-agent.exe
52	AgentService.exe
1988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7eba700c585f03fd.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_103843\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3ae5c607607dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8e9d0617607dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000638474617607dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{A486CCE3-B855-4F78-8939-38A7AD9E3F63}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{5EF60C5B-760C-46E1-BAFB-A7FF82D67FA5}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4848	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
1460	explorer.exe
1460	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4848	2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
Token: SeTakeOwnershipPrivilege	4988	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	52	AgentService.exe
Token: 33	1988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1988	SearchIndexer.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3148	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3148	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4988	elevation_service.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe
Token: SeShutdownPrivilege	1460	explorer.exe
Token: SeCreatePagefilePrivilege	1460	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
264	sihost.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe
1460	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2020	StartMenuExperienceHost.exe
4228	SearchHost.exe
1460	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4628	1988	SearchIndexer.exe	101
PID 1988 wrote to memory of 3028	1988	SearchIndexer.exe	102
PID 1988 wrote to memory of 2824	1988	SearchIndexer.exe	103
PID 1988 wrote to memory of 1500	1988	SearchIndexer.exe	104
PID 264 wrote to memory of 1460	264	sihost.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_bf184e3ddfbac7d8c93a94a004e4d965_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3664

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2856

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1952

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1780

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3148

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4352

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:52

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-28459746-3881314244-166055492-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3028
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5464

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:264
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1460

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4228

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0df03e21cd0a781206e76eda0f91238e2fd5208ef7d5f321a6030af7a8b5bc99
MD5 eafbdda53bad76d65fc8870ecd856216
SHA1 1a2c456e67b4884627d4871d49b4ef71ea43322e
SHA512 16042d0c3c432349154397bc863e491b6980c5adc3d3f7f3f026260d52a3f249bb5400e7fe48b7d5797d212204aad7e9c81409ee6407cad2691f8701f0f33625
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnce30jaNf1TWbdz:W3q6sjBxU023W
TLSH
T188D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 6423ac7c7eb190b1914e6d151e7092ae01abb52e2c57fd8fa955061429cf4d75
MD5 9374126fdc5f57d83b45f5dc59f1b94f
SHA1 74acb10fa18853f917a637becb3614fb6c240b38
SHA512 1d2f5483c04f2c47f2a660e322ac82c79624c4f554e2b40e3aed7bfa69167d67c4033aa4420df6488941226bbe59371fd97e153f1ded35df1b25473cc5fc5358
SSDEEP 24576:KXYfDtczA4gXe4i7ojhsP5Lgrk1TWb4AN5:Rtcke30jaNf1TWbdz
TLSH
T1F765F12877D409F9ED678278C8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 e311143a353a74ebb4952d8416583466204689f8cb6315047b77e7460f95a4c6
MD5 8163db5d1305ff0aa0ccf4966969396e
SHA1 691c32b2bb5e93bb0aad205786a566f9d42f18d7
SHA512 ae4f69743fca9bbb20ed86e79f4be2fb8fece580cf0273029faa2e9531355e406fe657f79b2a9b84218fc33d070240cfb222148607a04f4452d5a928f02d3189
SSDEEP 24576:G0Le5ji0hmxxrMLgXe4i7ojhsP5Lgrk1TWb4AN5:GPji0Aj9e30jaNf1TWbdz
TLSH
T18885AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 216b1926273d4447f66f763436c3b6c7976da612e255e8b0ef1c716dbfea7583
MD5 059e39de6b8bffcd174191a00373069f
SHA1 38cc059b25355aace1f46cbfead9d6170c665e16
SHA512 b5c5e85a47b312978913961dfcb2454fc07463530c0325b6c117a6710ad97412d0f1249de4843f548366a56dd1b6d63e9bac69fd71da3b37741a1c52b2ac8d14
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWn6q8wyuJgXe4i7ojhsP5Lgrk1TWb4AN5:E/ezSC6vUzPveHjype30jaNf1TWbdz
TLSH
T1CA756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f7c95cd316c4d54add687113d5fa79cde9e0368b9dc11c79e272b26ec707b7b8
MD5 bd9cf83e54071856e06908b9f959b8a8
SHA1 e7084b99908d6fbbf0c5d9e66990fd8dc1c24180
SHA512 0eca73cc57706b26b5e6e211abd78433e06bd083d5080ea204d251f39bd70d7adcbd2a25504c69a578789187253ae30be118dd91166bd6c1a69bcde80429b4e4
SSDEEP 24576:/VbqPb88hv/l+YMgXe4i7ojhsP5Lgrk1TWb4AN5:/VO88hXl+Me30jaNf1TWbdz
TLSH
T136559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e6038117f81c2477414851e8e660e6f8989d2a13c0ef0696b7ca0ee4bb0dba0d
MD5 f9c695badfc3183e5f9319a2ee84775b
SHA1 831b42b72d76a2b92d5c4bc59c9fc858cfe4e44f
SHA512 355d57c00434f66c4db8e60dbf39fa4751d82cc80ee73a8d8d225da1f58e3e16edcd99e5b8ffd74dae0d30ff3faba0ab3f5ee395612dcc7bef8fa90e8d809fb7
SSDEEP 12288:CLW0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CLPgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17E4523929F5409C6F38FC3F4A0F7CB91E9A11EC061448E6B47E0BE931DBC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 36f68cc8c56dd402c15c697c23d2bae4843a1374d2ce45bb273279d5d35dd8bf
MD5 7679472578d64d156c8ca6c2a7fe463a
SHA1 f6c825d4e79b58329370bbeaf7afee60784d2532
SHA512 a986777aaaaa07571d63f97fb5df6cbe0c8e6eb55afb9649b8fc3d14ccf3182f378bb033a578e9ec82e930c68b97d130157cd78331603d8268d84964bcbfc9d9
SSDEEP 12288:weBNUbTVO86U30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:wJIUkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13865CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e1a7ac561ad8a4819dec0194e01173559167f0b8760e431e9b2ae09a5abfd33c
MD5 0b6ee18dbd236eb73f399c2c13c9b97e
SHA1 1cb62a9a66fe9cc3eacc7c8f796b162084138872
SHA512 3c9c918c4abe7b64c43eadc4a72f4590eea8f5a631bbdcf707f33309977323549b64d98a726925329372c2b5d7529ea4665d8a7618e6c39cee69a5f2e38077ec
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THF:bQvGAdlCEL8c/DRNw5CEU023W
TLSH
T149267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4036618e5065b85445686d80009c48da15d2054f167e4ea8bc414b0ba9a2887d
MD5 3d58b6e0f4295782f26a63d5e76876a2
SHA1 8908f33d15cc66f92860054eaef649ac7f5b3f0e
SHA512 1acc29177407243c040c024def4e876d88a8c18b1076e99f222f11c61d77a2947202f2f937798a8236b6d6d8bc72f408ae1dc45f3b8d0b5374baa63b12ec0751
SSDEEP 24576:h0ewsAjqgXe4i7ojhsP5Lgrk1TWb4AN5:aljNe30jaNf1TWbdz
TLSH
T12F75E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3929e6aca07a1a603eb40c9e320e2a1161558810d400a404d8e2e6213341b819
MD5 bc0ffc4af3773f291176da0aac530413
SHA1 b651c2c8c067154579b2ff6dcaa94b2084c64cab
SHA512 1785d59b0a27f2ca188fcfa49d83c5b8cc79a477a5ef7b686bd2721ea96cd4737fb39a27d6a31e2b4f516781bbcf145da094ccd9ab2178aff3d54f0ebe886af9
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFp4W:eUEtQevvqc2W1cpV2tI32X4W
TLSH
T1B7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 feb7b89f376c643ace18e9b1d883e6a2fd51e516d870951c452f120fd97a98e3
MD5 26819120fef8344359d81016921cb551
SHA1 6a13317b184708fed62c234812aa26b6a50fc0ea
SHA512 9968b26bf63e4be080d59cfbb77d557dd55cf6e5936aff1dc731c0da18727d7d5674113b1bbb96367c32772b14b86dd8c98e93d5b768e43e74ce83cef8646a3d
SSDEEP 49152:WCbRquA/m2yL5zTfFiV+XenmE3/zte30jaNf1TWbdz:boquVjnmgU023W
TLSH
T185D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c3649de497329c022ea4d7ef90f878fdd799f559b89fbb1b96028ebb2cb58389
MD5 fd96f23d3ff055c0fa4177b542b7aff3
SHA1 183ac925719ff3e0f3349650ed9433690fc785e3
SHA512 2c1c28b770dd0d342da5dd0f5bd2f6c6eed40e05fdf7758d438017b39845c0812fb4703b4e34350b9cc64a5276c0cfccbdf6ffb2b9939481aa4cceb3df3fce04
SSDEEP 24576:DAhGL3IFoiwtA5l7S53VgXe4i7ojhsP5Lgrk1TWb4AN5:DAMUFoiq5we30jaNf1TWbdz
TLSH
T1D4359D81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 befb41d82cee0dce7b363c4356ee60bcae9a9d290623bf97156285b285b654e9
MD5 caf21176b589a558dff7c976beee6b73
SHA1 0854fb57e64d54d4d95ed3e582ed25ef6b7f33a9
SHA512 f20b177cd110607be71404723a5a92b082911963c868bc7da8f60c57f0fedc20a7e4ee3f3b53c5a4129b8b47c100f2b3e7f63e3c88fc975de1a5c506394c3cfe
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+CI0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:zwu4OWGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16965E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2fcbf681c9266be994abec3ba029ec3b8958ccc2dc6302ec36f67b622b53ddc4
MD5 fdf4bc9434d20c385f2e451d6a33e9e1
SHA1 219f031a698e73314e56bb9b7eaf35fabf13c552
SHA512 d1871c1957f191e92021a97dbba862a8d70b91f4974d9b545755dffa36197caba42663e5b2d47e560bf0b2463b04e0681cde15fcde26918f9db319a345b48a6f
SSDEEP 12288:heZ1IyN0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0ZuDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F955129637E421F9E2978278D4F68B41E7B23892233147CF02A096A71F76DD65E38731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 df11c25d9ec0b0e0a9b341779c8718299addfb0c5450bd6f65ce6f9885f32953
MD5 e8e218c187fbf330ba2d2f510d357b83
SHA1 4c727934caf5328b6401063f22d50c10fd05012a
SHA512 5404b908f281d1cf60394fa36ce9e977139841360b2426d424717a64550fdeac6849e5a7e2aea1807b83b3dd02deb2e12b1c9122e0045f9cb779094b3352c11a
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UZ:oQRQyi36YOcPbLvw2gAf+PN33U023W
TLSH
T19B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9e7b0e086d4a3b6294174a24bc1add12db82b6b0c0430d5ddebdac62be2c0c9a
MD5 a9e54a92b3b818d2c87ccc8fb8128a44
SHA1 a2f347910c7b982507a72906f73ce7ab2c35f9b6
SHA512 618129c66cc642583f4b7d9a05c3967bb7497d438bd6871cefe3198486c1c3c7ac06c643000458411cfd39ba941ba42c8138de14e2c7a4cdef248efd52605209
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UZ:mQRQyi36YOcPbLvw2gAf+PN33U023W
TLSH
T1C3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 677129d6746780616d17976fca82be483ad310e72a163c080cf326e3ff29b194
MD5 12a89d89cbee4a134ff2301ec08478b0
SHA1 a37feaa4818770938d9f5375ad24afcba58d84ef
SHA512 660982f15d17cd5304546d5a205bda678dbdf4d08ec6a7fe25c709f5a4720b51e79abcd05da6b72b5c073dcd6b461b0b2527be4c6e21746d737e98a62afe02b9
SSDEEP 49152:n68Qg55nhceWu7PNU3/9e30jaNf1TWbdz:RthLRc/9U023W
TLSH
T11AB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b6f431d06ff673b060e654855346f0f9cd0192376e4859fa1d91c17a8ae335ba
MD5 28af8ce626a5dc23be332e805f66f0be
SHA1 715d57f0db6e1b2454a200b77b1949d27123db42
SHA512 30bd4f501b9c3192dbb69df7f34448df9bdc45b41398c10667e78eecb36f988bc56ff034d0824d149e0b7577da4c74e2a4ee935c307cff29a936a8bd30d58fad
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99/:ry5112gYy5azzVvt69nLKnhZGU023W
TLSH
T1D5168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3666880a3a8f3a10455ed44e9a932fbe9f7b1d428093d2616ddedd29eb4449c0
MD5 19b937214c5256f03f3b261e1ae66a12
SHA1 9458cef296db15f53789d1f2633f516726cf9b99
SHA512 e80e6e9a08a3ea9a57d07a0b7b4b220b5f3a4e1dfbceef32ac6ba2a3e43e2773a50d4a2c6f9d6d7dcfb0ced4b973870077377470a976eeb282ba5ff78668d131
SSDEEP 49152:JB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glle30jaNf1TWbdz:fu6Jmdxd2dlU023W
TLSH
T1B7D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7c5e76c4f3a7960a9740ddea298a54642f133c4d6a716b9a4dcadbb4808dbcf1
MD5 ccbd10cbfa480754e8bd0ccb079b0ec9
SHA1 5bda405472f603f5f92bb76449a15cf2c6197dbb
SHA512 660b807fa098abed3e9bba36c05a0d5fcd54651b7849bf7d15575a2220714a65a28205b5dc2dee2b7f0b1e3fb6966dd60987ae6975c788b4fce3eece506d0a7a
SSDEEP 49152:31hpsNoJpF1A63U44CwH7R4xre30jaNf1TWbdz:3mifPWRgU023W
TLSH
T13AB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 731933d757969a9ed4324107669b67cfaed7b26de857e66716237ae96d66a583
MD5 3ce2d80a676c3036b3636eb52d390b1a
SHA1 07f8bdb4380d84c1b991968581b0a5b9be9f4321
SHA512 44d29beb034a940e65cc699048a4b82c8436706c1b36ecd5daf2b7432ed5dc340c0a7598f60a3be8e7b5573c97fb6dfdf5c3d7e898f7a766c343d7c7be71a550
SSDEEP 49152:BSuZQIY0Be2KcRVtOnks6NMHq6e30jaNf1TWbdz:P5dKii616U023W
TLSH
T181C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d5cf2ae11aee569c6942b0db6b46e9f448ab5b1cf7d97179ad411a94cb85005f
MD5 8cac78d7681e69b38dc3873440616e53
SHA1 6fce41dfa4a173a1b07c47df5d428251cd7a26b3
SHA512 73d27307dda97903a5ac75f04f7dbc1d30f97529bf457495908da18b012e7c30b0168c769b3c56c4c52639766ce7e685f9bf25dfe0136a4797137062c09c00e6
SSDEEP 49152:IhtSn8EApI0fig3giDn0AP5wPe30jaNf1TWbdz:ZX2imphcU023W
TLSH
T13095BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3d2ac88abd4a06ec97ddb0a850795af939ce95e74a6bd1d98df81fb3b82dbaf6
MD5 3fc5583df9622dadda3675d6725306df
SHA1 0c2e44422ac6752473f2dd2531a93d55381430e1
SHA512 2ecf1cee28ecf0d2d61b19bc2d6a473311c5daf5ea5e137abdb3a9176d3b327bcbeb3b859e3071394a02d82d2b4a5fe3fc9aaf3cbf6cc56726e631c854f8510f
SSDEEP 12288:DO0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F14523919E550ACAE34BC3F0D0F787D1E9A11EC272404E6B17E0B5531EBCCD96AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9b000bef351a6690c2b21575d454693f3d51d10d021b2f11d64bf14f47a6df80
MD5 f86b4df7b33a5adef114888e6f42a100
SHA1 212e4485a83eb67d2c893dd20eb32253ae12743f
SHA512 7b3973e79c00922d75eb5380431e71c2bff5ebcd85463f3d612944da781eb46d7c8894b507fa5cca767d4b511f1e5dcc433f9b7bc50e72a6f74e0a6cb4c8ce76
SSDEEP 12288:ph0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T140452391AE550AC6E34BC3F0D0F7C7D1E9A11FC272404E6B57E0B9531EBCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 d27944d7f6d27fcdbbc3ad8d451ef73bb914fb776fac44c88ef7f03b73b8b387
MD5 c7a44e2f61100ad3c6257af45731a6b6
SHA1 0d132a6bf6148a043708153335b5fbd00b49cad9
SHA512 c9c87fcf365585cba7a501807124a3fd75559fb6b8f8274903b1c96f972a745ee46e8de74aa25957a64376338e6b7fa28ea72ff6a105e9f28979cb06f8a679f1
SSDEEP 12288:mP0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T179452391AE550ACBE34BC3F0D0F787D1E9A11EC272404E6B57E0B9531DBCCD96AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 85a64485a64aa4a510d55b1325896a47dc6b153d180ac9611c56316171bff22a
MD5 54097df6cbeef2b1268ca87bab7f8623
SHA1 32933555ef00f7962d9c59f07990ef2bb8c8108c
SHA512 f403f92235e3f228608b2d030199a9172f059ef36ae4ab901f2d1a56e94862365142390fc7c1a73921378bfc8ef6f17632a78720abc871f4c33b417018f787d2
SSDEEP 12288:EVU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1304523926F6905C6E18BC3F4D0F38791E6F13DC173114BAF47D069530EB4AD86EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8ab4fdec48eec534596fd9772416cc4bc8a53e59c9c656e4b691d87279b6a3ac
MD5 8fbb4fb4861e3cd00ba96de957d18c44
SHA1 6b48ffa634d4283c787c7689dbbf1ef3aa7a561b
SHA512 7ccf00bf30e3b71634498f544593ef04a6842b61750f230f81601ae0e3fedd6d6c217de7bf2fd67f9b34b13f767f43f75f7427b6161dbee3865902fe9d4b2ad6
SSDEEP 12288:Oc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:OdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10F452391AE550ACAE34FC3F0D0F787D1E9A11FC272404E6B57E0B5531EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 793cd992ed63df947f18f4098949a8d84c00a519f305949bedbfdd8a17585130
MD5 21af495eeaff044c5d48eeb292702df5
SHA1 5fbe010f2d3dd2d8e28a89c7204ed4d913b4ba92
SHA512 2f770e8af19ebf574192b87c8f5055f26dfa33cc2afc5da16108417e32e150cf8fbf862eefd29572dfe7b8cb7303a4ffee3bd5e22c152356019eebdd8dfc287d
SSDEEP 12288:y10DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yCgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AD452391AE550ACAE34BC3F0D0F7C7D1E9A11FC672404E6B17E0B9531EBCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 25558409c21cd0f3db0695444cf1e4abffd06ddf05524c6f0c544c78cb94644f
MD5 7df892578f3f8a8832886f3eb5605fbb
SHA1 881a6758176314380c6cc08b6d426a4dead5edfa
SHA512 9cef55f1fd288d99156bf2a3b5f6bfc66df7141ea83ad9e3176fd93d029726f537670e67bcbe9fe93f596019d100831894525d3199932a442107850034226739
SSDEEP 12288:MJ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MWgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1134523A19E550AC6E34FC3F0D0E7CBD1E9A11FC272404E6B57E0F9531EBCC996A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 abfba7929a403c3ac4fa70aae762bcd70ab26d8eefbdcdd7ed4473b8a079b461
MD5 b7e08ab2e4c94263813e1271c9fd0c87
SHA1 08b2965448d2151fa040b7cdb13d09e0de52d568
SHA512 b48e42c4ec033898abfd4cc498bb729b08a5e96007d1b12fc6f1ba3287cd80a5b29ea091dacca1cff085f1093fb9876a652b25da9dc18e627c05d1fbf362091a
SSDEEP 24576:zZMRzFVSOugXe4i7ojhsP5Lgrk1TWb4AN5:zZMRzfle30jaNf1TWbdz
TLSH
T110650195B3500CF8ED67827DC8A68A02D6B27C561760CA1F03E436671F737A11D3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 0ff5d9ae6c11d87f002874a894af313d007cc26c16ebd49bdf00efcb84245982
MD5 83f5c453ed8add33b644eb82050a7448
SHA1 52a4e7e724928874dca451b65cdca7fc70c55e1c
SHA512 64d5283216a25b116517403da94f111b0af08a617c83b7d6a3d54a9ae428464872e56e536e0b4f5d2a2b22ed7735563de39db3ab6e23eb04e25def19264839e4
SSDEEP 12288:4a0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4zgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T162452391AE5509CAE34FC3F0D0E7C7D1E9A01FC672404E6B57E0B9531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 13b63d95bd8b3face8ad85b24310610a5b060bc57501e7917dc6f69702cf8e1f
MD5 4e7a217b246d69e2091a39ed008fb1d8
SHA1 d07c2e5712a3345b07e1425c43b4f0390cc3b545
SHA512 473c45c0a949c04ee1d3b095475f9979ecccf7c9d5bfbc401d991462b2c5748ea64b3fc57af16040995599f1dca8cae605970fc0c0c8ba556d9b67e01e22804e
SSDEEP 12288:Mm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:M/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B2452392AE550AC6E34BC3F0D0E7C7D1E9A11FC672404E6B57E0F9531EBCC996AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2ef35aa8bee56d449d1228bf9f4bba7292147b6aa437d224919c44029e4a4d35
MD5 5a06edfbecdf88217c17d39f42d2ebf0
SHA1 ec553f96b37259165ae9337c2d341a3a5f3e463d
SHA512 74cdcc3bcbba8554f5cbc1fb493df457068d304ce73a23ba0f09d9c0e0933a59db5034b7544abf904f54c4c0da09960e8735d60355a7533fc964a7cdcda5e520
SSDEEP 12288:LyPz5L8N0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mzyagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BC55025777A120E9D1678278C4E24B42F7B2787217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ee5c2565438e4d474b066f22523b7db93a0ef138df33d952e91a16b3d1edbf6a
MD5 3317518158c781804f88cc0717df8823
SHA1 04c0a25ac94099db5d9e84ce839dc32e8b6fcaf7
SHA512 b8d25cfce8d24be70d82db054640d6b50848da3658514d11840fd6ed9bc24271a01eebbca8a647153ab115a541c529cf683e9e2f9e40936ba0bf47edf33fec24
SSDEEP 12288:pa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:pzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10E452391AE5509CAF34BC3F0D0E7C7D1E9A11FC272404E6B57E0B9531EBCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e186326087443cbbe536f69b6e7e5a87889c43e8b5b9996c5eeab40c1c08c4b6
MD5 fddf43d67da4b1f9a9665ff66a3679e5
SHA1 f13b0c312b6f1300b3012834cb528d8ff8dedbda
SHA512 89fae448492bd6cc40a318b751a80b26d4cb4b5565e35b5c0f37ee1ea7407452a1caaea5052c8720800f59063b49c5e68ae3016a77259b98458e64db38a34711
SSDEEP 12288:oa0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ozgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D7452391AE5509CAE34FC3F0D0E7CBD1E9A01FC672404E6B57E0B9531EBCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 a38e662327db394b3d1439f53c51283fbfef16b8dac86af6dc8872e5284ffe2e
MD5 3e4450d075bb9df44507d2eec643b6c0
SHA1 d43d0814ca3b36ed4b48937a2b0bcfe4cdd70c89
SHA512 43b173f378b8795b58aced512b17d801e08fb71e99e37a5666390d58306ed3733894c40b71a5918e398177abb17cdf9bc9396db4a68c4416ddb74d2d2b6bf1f3
SSDEEP 12288:NyPz5L8N0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:kzyagXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11255025777A120E9D1678278C4E24B42F7B2787217208EAF13A057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6037743ab5f9f368edcaf5cb921adca3f6baaacbd4ca2f90cbb75d38bcb03608
MD5 887a558610f3e363c75b84024d3aee46
SHA1 0c91044ed73e2fdcd66845d2d17ced930dde5d58
SHA512 00e3e955f4aa5fd3e799d5b417051c26d2028b931b4faa754e9057941fba1ff73e56e8a157bd21e80599640f73883abedc39ae22cab4913f631f2b48ec1905e7
SSDEEP 24576:mTDaLl3z0zDsgXe4i7ojhsP5Lgrk1TWb4AN5:mTuLlj0e30jaNf1TWbdz
TLSH
T1AA6502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e387b2b75f61f51742afedd9f7365a945b1cd78540fbb9cc1c37b43291b721fc
MD5 0233e2464fec9d69e76ffe1266138127
SHA1 13dd93df24673e43c3e080781abe088bfd746790
SHA512 0b01d134eb4a13cddf60f4d3ebecb155728ff171c124df983497fb3cd3286e776515ce4cbb422612c1f3668939155ae79b2ed8e2a933af8b06059a1c669fa704
SSDEEP 24576:q3vd9CHKy7GZwgXe4i7ojhsP5Lgrk1TWb4AN5:Mvd9CHKyale30jaNf1TWbdz
TLSH
T11375CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d157ac53463c1bf88ae282871621148a7dc171ec85c1ac2144e14a0423463f6b
MD5 9d280a530f5d8171c8362e79e065ef52
SHA1 d7bef753958221406a6cacb773aafc8287a52588
SHA512 1bb653eed34b750f46d04d12f96d98b8c811d88dc520dc8c56859c496b8f88c60848fb40b3af74d0ef94eb91cd0de5bbd6a04447305cc608d295a4098a6e9b0f
SSDEEP 12288:Nv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:N8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T153452391AE5509CAE34FC3F0D0F787D1E9A11FC272404E6B57E0B9531EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 680c54cc2cff80e190fbdfb455e4b53366e3d3d8b1fa17c02bba87cfed96fc29
MD5 cc3658683452e56a19b3ed5d0b5fb684
SHA1 b920c38b71250129e47a7187fd1d46c0fad4d241
SHA512 fd7eee4da98a305094b313a307caf008fe8b1085407e192a51c24664e5ea09a2b4eea5634f042a75ca6e2b33422190f98267f83476060854cc6175d9548ddf0e
SSDEEP 12288:wt0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:w6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1824523A1AE5509CAF24FC3F0D0F7CBD1E9A11FC172404E6B57E0B9531EBCC996A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a6db46c256839864aeb749a35ba611ab641ee65f0914df7b9fcf2055b0908322
MD5 c36bd29e2e70a09e5cd5f2013509f437
SHA1 22148051f138694d8fe28150f4d1c41c3678f17f
SHA512 2ab4b734f3231698e719f552fdf886533304045fc24aacb0b14185a8a02f415b3c1fe2c3790841a4466e400764e2b26d747189a55af0e6decc8474a3841c0735
SSDEEP 12288:Mw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:MRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T198452391AE5509CAE34BC3F0D0E7CBD1E8A01FC672404E6B57E1B9531EBCC996AD846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 3b6c2b9788d290e2434db6eb28ef9788c9a3c892365b7489b6bf52f9cd433abd
MD5 59e9c495bbd8f6d8027ca0a7aaf01dae
SHA1 a730a31758385c1084fdb0c2f21dc0f85d1cd3d0
SHA512 4e30f0da67b6205a2f06f018a88bea52405f143344d3e53595fe03c61726fe5ab4d9aaec1c1a510e40e9e766b06dddd5d12559a34256b29d05d25a10172cab24
SSDEEP 12288:va0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vzgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CD452391AE5509CAE34BC3F0D0F7CBD1E9A11FC272404E6B57E0B9531DBCC996AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 581a2bb881d5fb9cd3df06709e9e597b6a56a5aaa02fba5480e53bea8d7bef66
MD5 91ff603e31e5136eb82eff602b7317a4
SHA1 dd8025d012124cb3fd60b89de2a9ee8a3d9b861f
SHA512 21958b0adc97ecb2f1095a97989c569cff41c508e1d84da650cf0dd801a891a421ffcd253850d8d700d158b2f247e48f6681fc99e54a99c97223c3d802dd2776
SSDEEP 12288:mv0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:m8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10D452391AE5509CBE34BC3F0D0F787D1E9A11EC272404E6B57E0B9531EBCC996AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5a6fc10542facf03039311d3858803a243f35b9e60a371e9a9d98580402e6369
MD5 68b0dc9bd23c5410bed8ba91bcb3170e
SHA1 ca1e7150c14d114be0ceae5879b0befdda341369
SHA512 98d01009536cfe313b2aeba81715c6690a106b28102375c6cba81f9ece5c0feccdfaca289911cdac51343cc80135db915094325296760be87e4de23f8456956e
SSDEEP 12288:oC0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:obgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D3452391AE5509CAE34BC3F0D0E7CBD1E9E01FC272414E6B57E1B5531EBCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6afd1ee269e225cfe269625bf5c9d5e06e6d697c041970cb3bd99d0f21d221d6
MD5 f47ebd7beeaacf8607fb257373aab7b7
SHA1 9b9bef104b5d076f492f3eef0cb1e6103d41e33f
SHA512 c97c993bb5b2623827c9c60f8cff532f7c9720a0e80e7113278ab2c4b2ad43b095879c31d2b93165e10b96ba76aa8dc1a247083e5670239f46990f72d9acb42e
SSDEEP 12288:Uc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AE452391AE550ACAE34FC3F0D0E787D1E9A11FC272404E6B57E0B9531DBCCD96AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 59a362c218efae4ed00928bc5d5a8437992564e0b8e62b92afa94e7d328d87ad
MD5 37e13b082e81dd5f91dc3a93e0928c1b
SHA1 ed7b7ca2c9b8b5aab0c4b990afd0a67a0bb1346f
SHA512 878c7789bbed014f07804cefbcbb6562f5bf3db2e785298263688640e46d16cdd06d04431fc38f64f0eec8bc59c5c76fb1dfb4262fc46abbb52dbd72a291600a
SSDEEP 24576:FfwvUk9RX6wkyAIvgXe4i7ojhsP5Lgrk1TWb4AN5:3MnYIme30jaNf1TWbdz
TLSH
T14F85DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8d5e266aeed5ab55dfa91003453a010b0af383e368fbd0c3e4de73caf604be93
MD5 a2fc2afdc56521531e9dc68746a6e441
SHA1 5a1d5644d015cefc81738c192122f34531a0acf7
SHA512 363cd0000ec83c541cfea4a55754eea313aca2ab6b2508e09fe5207605249b6f1f4d519ca15dca9fe60a132bf0fb9bc7ab499c0011c1ced1b52ce77d382ac91c
SSDEEP 49152:LYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ve30jaNf1TWbp:OySzPXU023W
TLSH
T187067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8dcba0af1c5ae6aaa0dd46c34f65de6b4ed8350c2f69c5a9b32f18c804239d00
MD5 9821bf6c131c295afb15527b6c000100
SHA1 9b77baf81ca708d347a4f476ead57ad1566d9bf5
SHA512 d05c0c7de6dcabf13c7e4b95ab7b61c0737e3094bce9f62ac94a20ac7cdd6a71e0ce19b847d3446629116f5087ed8a2cded3777698d0a085c4180a95e8aaa03f
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYegXe4i7ojhsP5Lgrk1TWb4AN5:F47JUQjTirIhCnDHUPfF//e30jaNf1Te
TLSH
T10165AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 04123fdeb1d461f78cd16d3929bbcc9180a9d614e9fee5f804dfa6e8f97e5479
MD5 264369f456fef9d11f20669a61003202
SHA1 2e3a8be5b94f407f1442d82b8fdf0f5d161b9925
SHA512 a7866244ecd1354c781805c75627e9e107e658e46f31a496c531860a4ce6852b0b12b3b5bef313e64356d0007253c57c38d1d5f32a3220a8cb684402fb9288d5
SSDEEP 12288:5bsfK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14C55F15AD29802D8D06E92B5C3968A81F3733C5193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f2feab300891078b9fedef9f7c06460a9870458e7f3fac2b020c1ebd67bbb712
MD5 82562c5cc85e9cca747f7de70eacaf32
SHA1 4b9994c3f118f8f93a5c6f24ac9161ca214104a6
SHA512 966326350a0fa6c0eb06f8370ab2d82b4fe3a13c79e5f98e5eafb6952e1650bf9a32eb42600d2e8fda9c5f8765c5d0e6766867cffe7ba20ca5b6970af98a3fcf
SSDEEP 12288:O5I7WU3fjzB06o7FUk+Y9k1S7iRMFVHc1vst4BD:OOaUPxE9kYiRMFNMu8
TLSH
T1EF351701B66AC78FC66940725E33C1CCAB707D41EE446E0373C99B3F957665CBAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 43b5d003265e585b65fd4f6c3a55582fc0f0d5fdf44021b365279becab2701f2
MD5 b5b32ddad0a517287baec576bb03d960
SHA1 25a8fe27bd3e8964f8ee8dd6074d25a03c8ffefa
SHA512 0732835b45b779ec4ad1f57704f9e36de301a94d89a35d0e71d200ccc416c5699d62496f2c8f8f5356810a6914c68e5937b89b82723377e3157db0d2152f7b90
SSDEEP 12288:9a5GO4PJWYdP/fI31AvjgTAPq3TsIHRcEgyxe4wHW9QON:9fYEie4QWnN
TLSH
T17775F941A137E38FC1BB607207269A4CBB64EC07B7496F2377C9453AD866B15A0BD3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 29e8e1096c6f636dbe14f3cb30e195ed7b7f11b9fc59a435e5318fd115d2aed4
MD5 5f73146e7f0ff60b2d886ce8fbf9fa71
SHA1 d64d31e5b1f64ff1f736e62219875bcf32ce5966
SHA512 81dabbbfd9e2c51d702b1e554a6e8730e914885a7e5a6bfed04d350fbcc5b2fbacedf0221ae8d155c9f8cdd263e3190003a00ab4f828ddae32f44b62a4e70c3e
SSDEEP 12288:L07y0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:grgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11B4523629B580DC6F2AFC3F090EBC760F5653EC0670089EB56D0B69319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cbee6216a4024f8594f42f760dff1c3504ca4462ea612243ad058cbb6f778c9d
MD5 88a71ab3a7147df34798b6ef1bfe8e66
SHA1 7a24aa132a410c4afabcf5cc3e1e1012455a475a
SHA512 b88e8991c24b6dd6aa563b1e1e5ddea90b54d72c6300f1052bb2d4757ab6b9f88b4da7c3666f0446a75ed7878fe605373bec46dc84ba3c789928cfe05c6ea9c6
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYJgXe4i7ojhsP5Lgrk1TWb4AN5:+gb4mBIBhGFxe30jaNf1TWbdz
TLSH
T1EE65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f27b72632ad8edd9cdc0424d17b5491cf701950e687ea7210cf0669da1a1c733
MD5 5501614462a4ca11b03f02be11199cc6
SHA1 3dcd151017b279bc365e1231d9d3590bf011969e
SHA512 2c9b46b034e637c771f1eb13b58b2c4c4315f59dd689bf90db0026060c93a4172ee2062362ebf17dc43311c2842e8ac7984aafe45bccc428a9c01760ac44bd0e
SSDEEP 24576:NG88u8FpJqH1bzria7/mugXe4i7ojhsP5Lgrk1TWb4AN5:A7ZFPqVea7/Me30jaNf1TWbdz
TLSH
T1EE85F16577E101F1D07BD138898646A3F6B2B8111364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8ac84c726e031b5d383ca9049fe822468e4414d3d331415bcae8769adc0fc1bd
MD5 54162172836ec8545cd252a3b1bce834
SHA1 9ed4bcde22f6cf371e045e2079fed41df43b374e
SHA512 46f002b73ce2b2b3c469edbf77824ca6f16ddefd58f91c50755d68312f0c724ddf8d8ac70d2da6744685ffde963493efb72366eed52e68d4d51bc05ed63ff28c
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVe30jaNf1TWbdz:YG05lO43beU023W
TLSH
T13BD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a6cffdccf09c837f5e4d10236c73016b7c0437223e10efc0729841cdd0b74ced
MD5 d76cca47d6f480ac3e2bc405e493f054
SHA1 365606f22ccb08d8d2420cd094abfc9e735c1353
SHA512 81e9e957392d7077537a6332fb0a74b14fb44d57ddecfad2830887fed26952c71453beb5d867cf917f3b80f053c45b1f74b7e88d1c42411c5de507c455ca3ae9
SSDEEP 24576:dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnYgXe4i7ojhsP5Lgrk1TWb4AN5:ta5POZ3BJt2pasx2+m9e30jaNf1TWbdz
TLSH
T1E865AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9eac4dce80ad0cec34f80c51e4cf251c1d7dbc969b35dd080fbfeb4710efa1ec
MD5 12bed21313c018d2bbe45ed20c4e23ec
SHA1 29c93478f37f62b7458c574c563b4c115f77617b
SHA512 ebf8f5d13408deefed6f7fa7a1ff0935ccf55bb41b4e585b7c323c7358c9a4974321c1a1caa4d18175505c866ecfdd889aaf4dabf23e2934449bc15c9719b3b7
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkmgXe4i7ojhsP5Lgrk1TWb4AN5p:8Nc/zEOVHFse30jaNf1TWbdz
TLSH
T138858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a5924cf0561a33c90144869abfbab56c6b920196028d414e67fa6bf6bad3e1b7
MD5 f7773206ee1c45e0bb233df73d10523b
SHA1 f0ae4dd3d4dcc1361e2d5ec1f171e02004a72f4b
SHA512 3e00d2697c63c36d1aa537bf915decb78fc6fbc11470dce6a470a69049d4dca3a7849daca45516c1733b91fd65631ca0fb503aa5dbeb0c1a1b1a30dc71c4a254
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmGgXe4i7ojhsP5Lgrk1TWb4AN5:/TMwBtOmJe30jaNf1TWbdz
TLSH
T1CB55AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e380629280937a61ebd0240c5a9ef18c316c1c9162715fe369a7f5ac5fe61a9c
MD5 856e9c8c6800ee9cdcd8260def7b11f2
SHA1 c0e291783c1eb28ad978eb0794fe28da94c91811
SHA512 a6c5b0478c61e3e7d92e4401a97098b6cf7134299a65da763d7a4d3f5304e0dcd65327541af8aaecbd11199d3d51304c28ae28161b4441cebe081563ba1bc35d
SSDEEP 24576:oPUr+NQygXe4i7ojhsP5Lgrk1TWb4AN5:oJQle30jaNf1TWbdz
TLSH
T1D365E12F66A818E5E67AE17C85828709F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 69fdb4e9ad968e384c3ec45609d08fd25edd21c1286821196931053cb9c1e111
MD5 52627eea00074d4256994e00df016781
SHA1 733a06b834705d208d8dfe5538fa3ab1a70ceae7
SHA512 ddf5149757c46243cd4eeecbe9ac8b3863664b0aee2b57faa0d3db011631d43b55c53229ffd166f38c348e1042fda721adfdb50a34bb9774ae0671baa1f8660c
SSDEEP 24576:YD3FHshBIYQgAHgXe4i7ojhsP5Lgrk1TWb4AN5:YDVHeBIAAue30jaNf1TWbdz
TLSH
T1BC75E17DEA5C04E4E57BC2BCD6A38A06E67138A9032156DB02D091B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/52-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/52-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/52-122-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/52-128-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1460-510-0x000000000E8C0000-0x000000000EA2C000-memory.dmp

Download

memory/1780-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1780-291-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1952-71-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1952-77-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1952-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1952-274-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1988-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1988-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1988-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1988-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2856-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2856-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2856-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2856-222-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3148-85-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3148-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3148-322-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3148-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3148-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3148-91-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3360-117-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3360-109-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3360-111-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3360-310-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3664-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3664-42-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3664-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3664-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3664-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4228-354-0x000002A082C60000-0x000002A082C80000-memory.dmp

Download

memory/4228-328-0x000002A0801E0000-0x000002A0802E0000-memory.dmp

Download

memory/4228-342-0x000002A082DF0000-0x000002A082EF0000-memory.dmp

Download

memory/4228-329-0x000002A0801E0000-0x000002A0802E0000-memory.dmp

Download

memory/4228-327-0x000002A0801E0000-0x000002A0802E0000-memory.dmp

Download

memory/4228-340-0x000002A082920000-0x000002A082940000-memory.dmp

Download

memory/4228-373-0x000002A094100000-0x000002A094120000-memory.dmp

Download

memory/4352-103-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4352-308-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4352-97-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4352-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4352-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4700-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4700-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4700-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4700-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4700-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4848-51-0x0000000000400000-0x0000000001684000-memory.dmp

Download

memory/4848-28-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4848-0-0x0000000000400000-0x0000000001684000-memory.dmp

Download

memory/4848-9-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4848-1-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4988-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4988-16-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4988-22-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4988-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download