c8cba89cb59aac7d9c2c36a94923e7f8fb38d5cc3a26e456d7ac7016545581d0

Analysis

max time kernel
126s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
Size 1.5MB
Sample260701-cjrl2acv4p
SHA256 c8cba89cb59aac7d9c2c36a94923e7f8fb38d5cc3a26e456d7ac7016545581d0
MD5 f2cb1b8544c2bf934111170224a66a96
SHA1 c807ee9f4146adde156ad444615055d24c26d491
SHA512 5567eadfddae56eb7ee4c42ee07407afb39504639c1215d5bbc1b43b508abab4874c84d43e91e7bde21ee1faead95e4375e627111c6aa02d566e773760f3b062
SSDEEP 12288:hyVOd/cmcJAmfPNsafJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SZ:hy+lcSmf1safJ4yL/tNCJPXUQrPe
TLSH
T14275CF0173E44099F9F7AA789AF59126DB337C925B38C68F0354415A2FB3E918D39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2904	elevation_service.exe
4196	elevation_service.exe
3408	maintenanceservice.exe
4796	OSE.EXE
6024	PerceptionSimulationService.exe
1500	perfhost.exe
480	ReFsDedupSvc.exe
2744	SensorDataService.exe
4944	ssh-agent.exe
244	AgentService.exe
5112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3d5f6e1880095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096108f4efe08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8ba6d4dfe08dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012b7cb4dfe08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{86C49EBA-1B0E-4F0A-9243-BC35E578D20C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{1EC873FD-88FD-4F4B-843A-42C655658E79}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2904	elevation_service.exe
2904	elevation_service.exe
2904	elevation_service.exe
2904	elevation_service.exe
2904	elevation_service.exe
2904	elevation_service.exe
2904	elevation_service.exe
5836	explorer.exe
5836	explorer.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe
4196	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5732	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	2904	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	244	AgentService.exe
Token: SeBackupPrivilege	480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	480	ReFsDedupSvc.exe
Token: 33	5112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5112	SearchIndexer.exe
Token: SeDebugPrivilege	2904	elevation_service.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeShutdownPrivilege	5836	explorer.exe
Token: SeCreatePagefilePrivilege	5836	explorer.exe
Token: SeDebugPrivilege	4196	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4676	sihost.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe
5836	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2324	StartMenuExperienceHost.exe
2716	SearchHost.exe
5836	explorer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 5756	5732	2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe	89
PID 5112 wrote to memory of 1272	5112	SearchIndexer.exe	102
PID 5112 wrote to memory of 2420	5112	SearchIndexer.exe	103
PID 5112 wrote to memory of 3868	5112	SearchIndexer.exe	104
PID 5112 wrote to memory of 5480	5112	SearchIndexer.exe	105
PID 4676 wrote to memory of 5836	4676	sihost.exe	111
PID 5112 wrote to memory of 1692	5112	SearchIndexer.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-30_f2cb1b8544c2bf934111170224a66a96_icedid_mespinoza_njrat_ryuk.exe" uninstall
  2⤵
  PID:5756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3408

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4796

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1500

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:480

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2744

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6124

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5836

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 301141fc1ca417d0fea38907415e7741bcdf22dad22acbb6a83832374d87e3bf
MD5 c4d0edbb3a3c292e9e927bddba5c7e8c
SHA1 32d213c1a20550f38e379c7ebc2409e60dc564ad
SHA512 d9a4e86b90c817ac773c60e4da1029dea294170e1782d91722809d30a0b00985579ad7bb45bb003d3a77224e645b1be29e61b2c1b4d346cb009542e5de8850cc
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxfJ4klKXnK:P3q6sjB2fJ4k
TLSH
T1B8D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 dd295776fbc7866afefda97cbcab8a3badd1ebddfaa7367735ac8eea72fea448
MD5 9e60b9d51b0e142b15c6dd4267937432
SHA1 90acd9dbf92827bc34e2a02721c5be8600a6ac2b
SHA512 6b245aeb4594309557d5339945cc967998839d6686f0aa607b7645ff5516be4988697f428e04c8dd560213f75373c1b327d70ee4d3e425ca0d5759d3e74df721
SSDEEP 12288:K1XLsswWkxy2lRq2czAqfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SL:AXYfDtczAqfJ4yL/tNCJPXUQrPQ
TLSH
T11C65F12973E008F9ED67827CC9A1C101E732BC954764E7DB03A099662F776D81E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 9d76f2ceed545b322392863d00d8e2a0487388a5d9bd0c36fa00bf914f0409fc
MD5 6a8d4406daa5ce282a07a27227b8cda9
SHA1 d35a572d8c8aa1461be11c02c2eed54b8f1dcd7d
SHA512 d42ea21496fa458de707005aa95a439ed8e9eab4d5ba006c4469bcd9a1c997ea649c0f614823649fecc07465a75faf23213a17994f1dc72c04abcf20b3ada5c7
SSDEEP 24576:W0Le5ji0hmxxrMZfJ4yL/tNCJPXUQrP+:WPji0AjgfJ4klKXnm
TLSH
T1FE85AE66F5748335D073C0B9C5D2A68AEA71308617308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0c9f401b450a6730f7f9ddcb443b7d9d9d292fe2bce7de42bd04af905e7582d4
MD5 ef8f11dfa228193fe9975a44665514cc
SHA1 99472b54bdb2edcd21e9ac29cf332657eb45ed2b
SHA512 872375fc829bd34e6949ed1a48dbf4a1a3f24fdf400c2a4b6db99093f5bfe8953ad6d6342491160fef3d35fa12bbec897a9499e5319c8426a3b65a6a7e1bb516
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWn6q8wyujfJ4yL/tNCJPXUQrPd:O/ezSC6vUzPveHjykfJ4klKXn1
TLSH
T10C756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fcf08843bdfe9e03c545330f658eb66f8e703b98dcf7cc9a08b3280fe7a5e0ee
MD5 ad14a76f543c85ac547dfd29bbbb43a8
SHA1 9fc36140805113bd924a5fe693fd179030e23da9
SHA512 b03112e3a33133ed4a98d4ce803002e57851604c04e85a7958f914ac9a182fe73a41d816de380d9eb16edb8b76978b079144d00d00be978192dc7c0bac6ec575
SSDEEP 24576:mVbqPb88hv/l+YmfJ4yL/tNCJPXUQrPq:mVO88hXl+7fJ4klKXnC
TLSH
T1E2559E66F5B48331D073C0BAC5D2A69AEE3234425B318ACB0246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e994915f0169b15965ed1cb4d08cf958b2d1884ad3f3efe028e0da7d3f4f7a13
MD5 3a7e2b37828645c3b659d0c5babd08c3
SHA1 930b3d75a178f703e98db72259bf0f2ebdcc3bd4
SHA512 c987f07205ce3e9a0f47787f0f6f170698bacf9fd1ad9e415c32f00b8a4031a9638b548b0fa6e13d2b1719ffa57444dc68c098da3d8bcf1a78199202e779c324
SSDEEP 12288:xL1fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:xL1fJ4yL/tNCJPXUQrP3
TLSH
T1664523E751809496DF6687F82A88F001C714BEC5162FA2F7DE82B8853FFC91A559C353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ad97d3132706dee4af8bd6c685612f07a88feece92029f2ad4cd96a22ae060b6
MD5 3fd54187eb6600f55b09d9461ac1f0a9
SHA1 55c11e093c6ed239fd20ea3d2c738d30d1f5b6f0
SHA512 1b812e06cc27aa846cb7d643d2a3d4acc2667c4f83f8b51f1eb5d8b3f68713814aacfc5eecb81b9e6ba8cf6495a7a092c0a44ca713aeee9bab2e6567e950c2fa
SSDEEP 12288:0eBNUbTVO86UufJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sn:0JIUufJ4yL/tNCJPXUQrPY
TLSH
T18065C07BAE28FCD2C67A8DB85B90C200D77278704B22A3CBD165C20EDE275E51D79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9d2b697a1d294ebe416c10a97770b7e9815ef82c9950b258fd0458ffcac8c9da
MD5 09dac2f01189ae2160491aeb55ad5b67
SHA1 4b9f34b0df9879f020dfecc2e9e5c4e264767a19
SHA512 868e479c892b452e9d68c2a12952e8181478ff6b01e3de49ad39bf44721f29361fe21e2b4197cd0f43712ec7cc170b056ac76b46217f6276810065cdc742b1db
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH8:4QvGAdlCEL8c/DRNw5CTfJ4k
TLSH
T1E2266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4360c2f2f2a1b75d0f33ca8436e2a9ba88a286c92a4ce412e347887f5ac2aa6f
MD5 e815142f7fbedaaf4e4ee8692421f14a
SHA1 6487539c57a8156e8b126753058010e35fb75d41
SHA512 4588bbbbffc152a671cbf9a88295ba4953c552b9a9f0223d1bfd834cd628aff8bea2d3fecdd71758e42ca9864dfb5be5aafcc34420b0e2385b7188c87dfd6115
SSDEEP 12288:FAwSfxL/2Dc3RDLLmt0LDQewsAjQfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yWO:m0ewsAjQfJ4yL/tNCJPXUQrPo
TLSH
T17A75E031FA74E036C77F0DB51B25D306552CBA604B621AC3E3E89D8E5A742D2237AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 efb45f9f3d8757273ad843585539eab393cbcb7a46ac7cf6c5cc443382256039
MD5 4851cac49feac601624e073dddadde7c
SHA1 db929dde755d1be4cc0af01854e337f99ee32285
SHA512 712a9f28ae8969035acb707849b2025a6cd32160dfdde3a423c649a4f8c5852422ad3948bee378f95f3b7a828f94b3376788640568cbe49c8beacf115b6a9b58
SSDEEP 196608:6UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIfJ4:6UEtQevvqc2W1cpV2tI32I
TLSH
T17C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5e3385e20ecc39d2f478ca54833b1a3636b6b9f169e71ac55ca8f08751da0cfe
MD5 9a8dd34569035579e6f83e96779b883d
SHA1 50a38a88c908fd2fb0e55c7444d3a76ed9017650
SHA512 ef69eb455114e30e81fb2addd30a3d4954c831948842f1823f2624154911d29f8a91962ad71e6d90ae155c71cdfbdbb8cf40e45d2cbcb5a5d9a647295ef4d33d
SSDEEP 49152:UCbRquA/m2yL5zTfFiV+XenmE3/zwfJ4klKXnt:9oquVjnm3fJ4k
TLSH
T15BD58D0976B8C1E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2696ab640f3fb81108468b6b2ecb0c1af278f43ee4d29be814dd01cba8339601
MD5 ac54884d3930f9f126c092771b0bd468
SHA1 ca1550057c3c5006acec3c87d97932aceebad0ab
SHA512 497e734d91224eba9daacd81f7c535c5f5bbcbd723d7d58fd9c9d9180ce9c8039b299cd376d92fd50563230adb596ae1ca0099a969c06a682b1efe50733a75d2
SSDEEP 24576:UAhGL3IFoiwtA5l7S53XfJ4yL/tNCJPXUQrPJ:UAMUFoiq5nfJ4klKXnh
TLSH
T197359D81E7F955D4F5B3AAB899B59170EA76BCAA5E31C20F2250D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e23b69cd79b7a2f91c0c204779295c80b9c79343c81e364e09ca7a328c4bbe5b
MD5 92217efb238b1f2ec132351f4870e9d2
SHA1 27c991e3a1d85a931d62cd13f86d31387f8a0737
SHA512 41edac07b6dc89679c1d2d7ec26334e875519a37e0214d0f811b0365f56a84f25564eb4af24bff11df34ec0d2681c978ebe70599eef9a870b9a6e40d4b5340c0
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+CDfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTn:bwu4OWEfJ4yL/tNCJPXUQrPj
TLSH
T1DC65F14A32E41CF9E96782788687D132F7B2BC422A26D71F4760C65B6F773216D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ede9d60aa7c7b5dfc712ee3a8e013efa20e11b0cab6b01ada5bc913086eb7e99
MD5 4b249965fefdd3732ede93c92139b8ef
SHA1 54e86f71c553d6def77e0eb8537aef7fbc65203a
SHA512 a8b5ed74b7d91077511e25d4a08e039801cfcfb5e1513ee71b04134435c407516eaba1a2fbc629212f302c37cfdca2e4f3ff53f33dc58b08f4890f4d82a58d88
SSDEEP 12288:LeZ1IyAfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sp:qZuhfJ4yL/tNCJPXUQrPi
TLSH
T14255129B32E460F9DAA782BC89D4D101D3317CD2233A53CF5A5195963FBAAC61D3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a07ee3a57e205c9cea3f2c74e072ea641fad23100b2c8c022c3e2a2d0c3c067d
MD5 002b96fd13f56dfa30bd1d9292eadb92
SHA1 21aaaf9ba092799357819de19c1b0b9f217292c4
SHA512 e66f1ac5f562f4cbd5769cce393180845d3a6fc380fa3fa17df0b9046c1209cc5fe4fb301b6b93a513504de6cf50fcb81af4ef16ae8fa86790d87a11bf16459b
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UF:HQRQyi36YOcPbLvw2gAf+PN3yfJ4k
TLSH
T148667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f8d9393d0d475595924cee467d4b62b99a3ff45f431e372227b098f8a19ee59a
MD5 4071811b34a7e5cbd1a4cc33647b8fb8
SHA1 310b3e53ef2be2ff6c919ae29e9841997f42b25b
SHA512 ec7df69ba40c6ac17f23ad43ec8aa7b26217fd6ae8637ceb84303a706375a1519b957ef71f23d1c7987012615e4a20ecf9c2d67fa039e5dec1719327e7d10119
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U4:+QRQyi36YOcPbLvw2gAf+PN3yfJ4k
TLSH
T1A2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5ee67b94bf1daf1ef2fab0af72c08ad6eeb91fc7b3e473c6f31e7ddf33e7e8d6
MD5 76b2125ddf348cb9f839abb50bf16e8f
SHA1 8701a5ab64669eedfa4af2f5247164f5300036c2
SHA512 c12f0ddaf90498e41995179f812196fff45d2ba0bcc93dd9e5a9a1bbefd7fed82d3ae952d44921398350f286efce01975a8dc81a92a06fa3b4e307de5ce442e9
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0xfJ4yL/tNCJPXUy:p68Qg55nhceWu7PNU3/gfJ4klKXn1
TLSH
T140B55933B2F600A9C44DE1769F4A972196D27C758FE1E3DB850172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 21340d0f10fe06d9775343f92a763d4377cd1653b748df6dfa9ba5ead205f8f9
MD5 8b1bd39f4a16af27a21957b9dd671540
SHA1 bc99268d9554bfc056115a5853cc36aa00723d1b
SHA512 717c785531b49fb59f33542b61015e1fd7cac1846af27797f7c3dd510a518bff32e02df4400670803aa032a262fdeabcb469013d0cccbf1df6369bb612b0e78b
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99C:ly5112gYy5azzVvt69nLKnhZ1fJ4k
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e38e87012ab78b90b8ad61661c537bd40c1fe87adbea161ef024ed7aef6be96a
MD5 9baf79661ce29822f5d28460b188083d
SHA1 0f9439326906dc61fa808f14de34298aa6ffcece
SHA512 94fcd666ca34da2a012de25d21a7dea36bb24f45601379e4a6a067a69f0bef7c5702539a76ab681ab49c5e4c27a851fff578d076e1fc0159f588582d9b52a3bc
SSDEEP 49152:pB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQfJ4klKXnw:/u6Jmdxd2dQfJ4k
TLSH
T1E2D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ceb761b6f1b07627cf4e49041d4e3af0c170bb7f41760307b2375b39fb3a46a8
MD5 7fece8798bb1625ca17321a7960a2433
SHA1 5c2f7c175f0f8fdc9382769c19b0f0cc2b193feb
SHA512 2c6ea3731e9ac152dda84896fcc18ed3ea6f5aeae07bab74d5c4c56b26aa728c187f8bf59a50ac806bce6e225d7406cab6c4b023ce6a5619652ad95a3590da4c
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xOfJ4klKXnx:ImifPWR3fJ4k
TLSH
T16AB5BE13F2D900E8D06DD17887569232EA62BC460B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d1759fe8a626dbd6211da9f7670a675b07de2554160e80a8213ec54044f10219
MD5 de70c9581be1e854b0ab38cde346dcb5
SHA1 8c1a918487e8711366df237eb64176299c4fb4a3
SHA512 a7f23d5db9b80f9dd2587d2b2376e432beccb1c8f4c8f2e7a10cff5984ea3b0a338e097c6345b460f117e4eaa2c85e65318673714a0c1867673be5a79b1e07b8
SSDEEP 49152:JSuZQIY0Be2KcRVtOnks6NMHqhfJ4klKXnj:H5dKii61hfJ4k
TLSH
T168C5BF13F2E940E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b10341022193b7fe7e61ab552c28e2395c98de7c4bf0e41db80c3091750e174
MD5 e29bedf1a64a5ae2126af558f1bd1235
SHA1 367acf27a6904f3f6637ff041cd4c090816c120a
SHA512 635575f28a375302fb524ee09394277d34b7a59ee3a013ebdf788f657c7a3e567f2a3462b0daaad3fbb3bb4af010957cb787d0d84435996b0a1264d6aef44632
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wqfJ4klKXnK:TX2imphrfJ4k
TLSH
T1C995BE13F2D900E8D05ED178C7468632EA62BC560B39B6EF0A90B6561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 50d76cd4c18ca39ebfb1371ba2404b837cea8674bbb124b6731c7930c4505018
MD5 727e68d668827e48798402b625386b67
SHA1 3b52af058a30f6b0893c8f1352a579902d1611c7
SHA512 756d2cfa1816716a7a0d1f6507ee5eea9b60ef8fb1b85cab9b75b56177043644c1123f1b5091d8307f071b623fc33dda0962dd330068b2635a21e1ffd34cd78e
SSDEEP 12288:CdfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:CdfJ4yL/tNCJPXUQrPo
TLSH
T1564523AB20D5948ADE1587F81A88E001C3047EC6672F62F7EF82B4427FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c836065140d8c4311cfdf428fe27545a00b7c0300b2fc93ec4735f4be6fbe7a9
MD5 71f156213953c13d8a065b1d0f2fca5c
SHA1 52eb6d64527a4b8e40746ca0bfb9808f763ff9c5
SHA512 1c1dd327ee20578e6274eef2d9a696a899d2da4296b2c2d93698d65c767d08ff0ac987824a2dc7f3a2956c0124325d2be4fa7e4e1e7ab04e9ef7c06714e153ec
SSDEEP 12288:M8fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S3:M8fJ4yL/tNCJPXUQrPo
TLSH
T1064523AB60D59486DE1587F81B48E001C7047EC6672F62F7EF82B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f0edaee30bdeb67c2cc001dc3446d0b0878e94b3de57a534ae724b6735db0956
MD5 2a78a3fb16fb825733215ae9f979d325
SHA1 d87f1ea98160cfb9597e12e0599ef3b89b1c866d
SHA512 20ae933e72d74d4bffe72a121fe9e159430f1cbd26c7ed9421e1615ab6ff657c9f620228802136bc698a6dee7413d846aaae2890a997402dfa959cd498827086
SSDEEP 12288:12fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:12fJ4yL/tNCJPXUQrPz
TLSH
T1D84523AB20D5948ADE5587F81A88E001C7047EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 c42cabd34ccefb4bce624bff741f50377e3c4dfea731c7bb659997a9207be456
MD5 6a01631ce4005da5fab42a0426945371
SHA1 74dcf9d94c2b8fb397874f41095aafec0bb3ae12
SHA512 7e0bade16d1d2fe08e51b323aa3b112ff1560a75701630ee7c75c6ff7ad82b7f39b70eefe42c8ad0e1102d187a311183cc93d38103246185d4e44b8781a01cfc
SSDEEP 12288:bV3fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sj:hfJ4yL/tNCJPXUQrPU
TLSH
T12C4523A7219580C6DD66C3F84A84E001D324BDC6673BA3EFDF4268863FF9659297C361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ef005fd2c9a057e2441dc3d86b6125abf1436667587725bd7d1c739d15a33738
MD5 b3409a3f9b2edf84a4766af9e47d2d2e
SHA1 1f9895e1dfa6b07c90add8ad1a6a4b0ceb33ac0f
SHA512 5f5960e71469764d2f214c351948fa2fc8974e5551bd7f4b99d3b589b6752b7a5f33f991df7bf387bc4ee46195f2dfa661767016890998c5f1cc6cfb08761258
SSDEEP 12288:svfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:svfJ4yL/tNCJPXUQrPt
TLSH
T1584523AB60D5948ADE5587F81A48E001C7047EC6672F62F7EF83B8413FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 593dd2229a1d89e2018dbba9d97c9277733ddfb6cd11b5bd7ee296f2ed570676
MD5 a0c5d7c283980a36265e18c02a5f7fc0
SHA1 9500d64d51d1759c4a1b7c6c39242162d629673a
SHA512 c5de90b1b564f084a61d2e84c382887a658b0b996a829a802bb4edef8dfd5ad8fc6116ba51ea64ba8bce095080831ab462e50b795e4bc0044a441eaeb9640dcb
SSDEEP 12288:Y4fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SG:Y4fJ4yL/tNCJPXUQrPt
TLSH
T1194523AB60D59486DE1587F81A48E001C7047EC6672F62F7EF43B8427FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1d20ac82d1fa933a376a9874e810bb0c02dd339dd3be54c60a227f2734e1462a
MD5 0c41cadff567f6eb9cefefa420ab4593
SHA1 a08974d94c8905874e1fb03e1ee4ba492a7981bf
SHA512 8dc875eaa6b741136dea6e5b341a3cab88aa02e8905d496b65409ddb5901e2d2de10934e98bba5e451022e71cfab666c9b3842c002bce92fafc8cd7820c0ca74
SSDEEP 12288:4UfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SO:4UfJ4yL/tNCJPXUQrP1
TLSH
T1404523AB60D5948ADE5587F81B48E000C7047EC6662F62F7EF42B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 247f926853960d54b3a44363764be0b14857f09c300f5881fd9085ce4494121a
MD5 b0b73505435709fdd0fb463ba6ec0bd5
SHA1 e850d83c5b69480ecfafbc2a48cb9bb135a27979
SHA512 4bdbd45b101e9133d6c6d193df1d65eafccd1d534cc480afc8b008f94230cfb7f167eb31f1b9a989ff068ebf8b0f63941bbe8a3b3e6eff6f3a34fa5fa2e36b5c
SSDEEP 12288:8iZwbVzzFEoS2cPvycfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sd:fZMRzFVSOcfJ4yL/tNCJPXUQrP6
TLSH
T1506501A5B39018F8EC67827DC9549902D3B27C9A0B70C25F07A436676F773A11C3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8583fcb435aa385e5ee599583b279728d94b00cb8cb6e9130643dc2ebfcb4d9e
MD5 c628c5af17ad19362b6d09dff30f7f8c
SHA1 a6f0f7a724f58d012e313f14a87860dc7a23728a
SHA512 d42df8701a8f70b6c41e20f9bdc45d6d81f61b90c35ca613223be6d02e78debef286a1356deda07724e9025c01247e803388d798d1bd3bf37fe052161314f44f
SSDEEP 12288:2RfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S/:2RfJ4yL/tNCJPXUQrP0
TLSH
T1B44523AB20D5948ADE5587F81748E001C7047EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9236e690a04bb9217a5e6577cd30c898625aaf8b2934cee29539ab89e461e68d
MD5 9a4248b49a90f871583a96a109b61c59
SHA1 621d6869d834f5656791698a221b59d95eec62bc
SHA512 98cae29b405ea09060e2ca38da5f1b5708fbf753877ed97ac0b7c017c21c3b107e1ca387e78b6391afc786f97e756a67ebd73a478e874801cfc1fe03a4e75499
SSDEEP 12288:4lfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SC:4lfJ4yL/tNCJPXUQrPp
TLSH
T1A04523AB60D59486DE1587F81B88E001C7047EC6672F62E7EF43B8817FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 3b552541f14693d193bdafe6685c50ce9587b84469f05e36d510739ccfc3169c
MD5 670b82fb7b5dbd85208281b19368183c
SHA1 d296d07ca2869c4f6a33806bf9169121c4438753
SHA512 d4060837f9781b75202510fca2715bd8a167e7bd72f47a9afd03a192ba70376cec7ac9ecde27f79363f5f467c48582b2b93d78168eef6229a2c3ad55c81e2de9
SSDEEP 12288:+yPz5L8AfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SU:jzyAfJ4yL/tNCJPXUQrPj
TLSH
T19355125732A130F9D53682788990A502F331BCB2072587EF5BA056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2f671a1cf14def390483d1db7d8f2460c3bd767ea7ac5df1b437da8e24fcacad
MD5 bb64b48df606317a49079aca4257eea0
SHA1 34cc74b7a68503ccb4112b1787b017660110e5b8
SHA512 f53e9780156581a52343d633cf06f9b64ab9a36058ddfdcb286fe892ae06625f7c34184422b6c59f1a895d68721800cce7e1315f011b80860a027615918ad02c
SSDEEP 12288:+RfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:+RfJ4yL/tNCJPXUQrPe
TLSH
T11F4523AB6095948ADE1587F81B88E001C7047EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2654515795f003feaf6ac1a5278694a8029369cc7ffe24701bb210a58cd9ae81
MD5 ed028a9d3c2d1c8181099221dea53756
SHA1 e47d7ce5b6301a1c9aad3087aeffa6418ec1248c
SHA512 72f24f5d67f2c46552405ce4d5db50f0f478793c086abd21c54a3a9b62598d0419c2c5abc3cc20a9be1992bf65a6c685245edacfef64cc74834eb2c94e1420f3
SSDEEP 12288:nRfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:nRfJ4yL/tNCJPXUQrPe
TLSH
T1484523AB6095948ADE1587F81B88E001C7047EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 47277fcbbb45e6372851ae6785abecc47c43b96201ebb80256cd5655492f18ba
MD5 464d0055b2b6b855847ce4bd6942ffae
SHA1 9a4c8b69d37c000c0345c42a06f0142294ae4a64
SHA512 979fb4a3138d2b7bd9fae232e54b59f45a44f0525b9805043894f4f7e746e81f33dc3ef277eb5f60cbd60781a85faa23d20cd0ffc71abc242fd8558eddbdfbd8
SSDEEP 12288:oyPz5L8AfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:pzyAfJ4yL/tNCJPXUQrPJ
TLSH
T12655125732A130F9D536827889909502F331BCB2072587EF5B9056B63FBB6915E3E770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 192ffd561d16b1193ad4da24c7db54ce6b07e820ddea5a5c19b95a3dc1c00a1b
MD5 bb1f691fb410b16cb6abf58e064a0157
SHA1 26dfafd0348c03b530ac29899fe22dd0f74c7d47
SHA512 94dc3806e03eb533401d215ba4ce2974a55a60a3534817ce36ba7ad53f7b5057856b93404d03d36104f991d7179f699e0786a39207c0ff357b110de321eb325c
SSDEEP 12288:VCd9CWYoaLHF3z0z04PDvhGfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYTV:wTDaLl3z0zDGfJ4yL/tNCJPXUQrPh
TLSH
T17B6501A5B39018F8EC67827ECD549502D3B27C9A0770C26F07A436676F773A11C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 1c79f840f7c1182babe18c12457acfb4d020fd020740ba59589b8ce206b2ea8f
MD5 a11c657f022e09f86b5ba3daa0f40a93
SHA1 d1f8403c00e1edc1de624b0ca11cfa7ec61c3244
SHA512 6fd0d110c2277a65a5f41ea33675074ac79cbfb4e48ecdda58c8bc318a21e7236428180b10920c3296c3c8eb47d7b03ffe04319f90063d5c7d034f31fce61ef0
SSDEEP 12288:Vi4e7KRdTfgwCHKy7GLbbdIvbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGv:V3vd9CHKy7GZSfJ4yL/tNCJPXUQrPw
TLSH
T1E975CF91F3E410E8F0B7CA758D659502DA767C9A1B31DA8F03A4655A2F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 53f960f9cfb45a7f63b155d1d239df8d18c4e2c9e489711f19edfbfe292d1cee
MD5 b3048866c32a1138551c31e81e9dda24
SHA1 26cbb9c6ca4c10b1a207552fb89bad8053267725
SHA512 b5089610f2ab701b39f8bc58697627e8d826610845b9338cb80462649620eb73961cfbee349ee7dc28ab93cbbba92ef5b50ffeb80f964ead13b5698ef1fb1b7d
SSDEEP 12288:IWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7S5:IWfJ4yL/tNCJPXUQrPO
TLSH
T1EF4523AB60D5948ADE1587F81A88E001C7047EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 464640f9beb01741976b3e86dcbbbab628cdd73faddfdc3325e4eddb6defe77c
MD5 188190412eb8fee570dfd49515151c72
SHA1 f4cb928c399d4b13f8b52c12f10906c877f20f69
SHA512 8c4140fdd087ce0b5de202cac7d6198bf3979d06c9a57cebc07865f3c179cef9497d309fd19a1dad8bf9ea68ae27fe9a13088b674cb23678469e5ee180ddf28c
SSDEEP 12288:egfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SB:egfJ4yL/tNCJPXUQrPG
TLSH
T1144523AB20D1949ADE1587F81688E001C7047EC6672F62F7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 00a1dd5a0fc76a0785ea5650d161f3b6e43d342c3cc9fbaabe8445046f353e80
MD5 ec15c976a3f59e71b171c07f2c905157
SHA1 d572f5822ccf67f1b5c84f0a97d4ca42e7526571
SHA512 8dea328e07678e9ff5c9542253a4aeca7b7c020a4fe6dd8a099fc4c5a78c183216b01b4ff04823cf299002ebf4bdf4f57a48c9885356c19d29b4789aca58f630
SSDEEP 12288:FbfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:FbfJ4yL/tNCJPXUQrPN
TLSH
T1D54523AB20D59486DE5587F81748E001C7047EC6672F62E7EF83B8417FFD91A159C3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 79131ff3a8c67c1c74eef2dada00907e1c2e5926ae09e1c7a7b866c1c42caabc
MD5 7ee391c85325fa01506b0357c6a2b06c
SHA1 56611d0ac0c5dc66391b98f6c6ebc453c473c8a5
SHA512 0015c06ff34074147522b580b8a67126f1679e407b94faf544da4ccbe8473a826953e89db46d1ce3743a19d7f1c91fb63227a6ff49fbb392d03b92e001d96d2d
SSDEEP 12288:+RfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SS:+RfJ4yL/tNCJPXUQrPN
TLSH
T1BD4523AB20D5948ADE5587F81B88E001C7047EC6672F62E7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f47aaa729bfb8b100a924b001267f71fe6c587d7f69e2be81e6de9f7d20acec3
MD5 0cbcc87031f70e98727fae1c2d71a95a
SHA1 f4be9b786eb364445d40457477affe6670368c05
SHA512 353b8f8388d20b67f9cc0850f99e8ba463663200be5ba476641df41add7a5d4c5c509ec9652dc65dd52307cec6246f99121e453e8ecaff151de2f68131e9b865
SSDEEP 12288:cWfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sm:cWfJ4yL/tNCJPXUQrPJ
TLSH
T13F4523AB60D5948ADE1587F81A88E001C7047EC6672F62F7EF83B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8365d54c5f3b6c160e38ee7b90bbd2097abe0e3318386774c85a6b23579338a8
MD5 c301b9751cbe044c32a36e60f013da6c
SHA1 77899b6d48cbffdf643fff6ee8cfdbe6aa30a930
SHA512 a852a0fc205c56a40d46841d071b4e2716c7ccda134246dfef0370bd5e5c93c15e89cbc4209a937724822b73dd93e2c21c4f6500cec13868c615fd86e27dbb66
SSDEEP 12288:XpfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SA:XpfJ4yL/tNCJPXUQrPX
TLSH
T16B4523AB60D5948ADE1587F81B88E001C7087EC6662F62F7EF43B8417FFD91A159C3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5af98553a9f052fd725451e73359c46f2cd72208c85f85f4cd9d384b10b45762
MD5 4ca3d7b6ed510bb5369b427a3ce944d8
SHA1 688a424b82e78237085c989f879cebb335af4160
SHA512 1880c468b4382ae632aabe942c0ffcdab03b2fca31c46f4ec6237e925fd499839acac006b62bc29442519127b6af5bf0023a2d4b3ba9a0104174d9fca54ff183
SSDEEP 24576:IfwvUk9RX6wkyAIVfJ4yL/tNCJPXUQrP7:cMnYIVfJ4klKXnz
TLSH
T10185D02AEBDC44E5E1B7923C89A7860AF3B178591B31C2CF029653AD1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 43efc379a9aefc039f3bf736831a1b67e735c315cad09fa388c2b41302935794
MD5 f3848afabbc43d1ec0c2028f41f730d6
SHA1 f8e7e068c115365b19ff4de5f656399787d0d959
SHA512 3f5763514a47867fbbd92adfd75e65916af2153f524e00cc29334feda17ff315cdc25ff6cf411891d14843aadbf082bf1d11dafc3f2099ec2109be7479e85fdc
SSDEEP 49152:8YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0KfJ4klKXnh:7ySzPSfJ4k
TLSH
T193066C96A1A801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 38b1a88e473a8591a6a3938873546ea8692b61f7d4a69117b5abab63619d652d
MD5 199e636d86e3f0d0037b9230f41300c1
SHA1 6c269c51b6faea8a5da690b71b47d9bb61effd4b
SHA512 4102e14e3ac5da021ccb5cb8ab5b32941170a77d6f8689e1b003c2de6f4362bb32b2de108ee2aa0ac5f881db4e3edf1bc16ecd119f87ed490ffeff086d35b39d
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYMfJ4yL/tNCJPXUQrP+:M47JUQjTirIhCnDHUPfF/6fJ4klKXnG
TLSH
T19665AE1EA3EC01E5E1BA82788515861AEA71782E1F32C6CF1270837D6F67ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 0579e318c0f510ba1e335be9f31570544cc37be5b93d69aa4661ea6c85f3d5c5
MD5 018061697dfc5c481c6ae522762ecc0f
SHA1 9d9536825599913566bae7ff6e67e49a52ee1d7d
SHA512 5fee8402845c36d1c77e1f68919f8f19174643af6b6504c1357b47dd1ad8030181477eac23fecc352d68110882f0513fa86475b0a6d3c82ff7cac8ae61a046c4
SSDEEP 12288:1bsfhfJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sc:QhfJ4yL/tNCJPXUQrPX
TLSH
T13E55015AD29441E8C46E92B8CB449201F3237CA593E2D3CB97C0F47E2FBA6955DE9703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b22de2c9ef77da3ea60137b4727141808b12e39b7d07395d621b8ca5974659bc
MD5 a08acf421f05cf9d7aff4163141aaaa4
SHA1 737b26e787f6609b361ed1a784b9e244adaef245
SHA512 9d3bc979a458445d725fcff9ec571aa24b0273f8071ddfbdc04b85536916ccb43b64eaf6628529e785558626b33fc2d943ab028514c552299511bc38bacc9521
SSDEEP 12288:5F0iEfU3fMPiHGzO9BA5vSswXJOayhcYhO1DFMlMBjXTIgg:5SiiUPWOGze5JyhQDS6BjXY
TLSH
T100452701B626D78BC5A950321E76D6CCAB707C41EE04AF0773C9473FD876658BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.0MB
SHA256 6a00a598f34c5b5b339adfd28e437015c83cf1224557f9c1ece2d2ed213bc797
MD5 7a8864eb78521b046023a872fbb45a51
SHA1 35a03d0add877ae901504c13ab59457e6cd754a5
SHA512 b36eaad25c0aceef9ccb7694acabbf4affa75e6adffb4c0a3010c7757775b1def5f807c37c6f2884f8bc6101a6e2e648d3558a8bca2e8c6c0cefce6c45be1390
SSDEEP 12288:tCj8IeOpX7qvb2JJZqH/zCfTh7KcrfI06TuL0RuARxg+8:AQ78rWyL77h3x
TLSH
T1EE352945A577A70FC4B95033133186CEBBB8AC06BB493F0573884C39D86AA59B5F27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

3d5f6e1880095f6d.bin

Path C:\Users\Admin\AppData\Roaming\3d5f6e1880095f6d.bin
Size 12KB
SHA256 adb8d2c324f9427f0f8b9742deb0276ff4efd47da24bf8298d7abeb93956e59a
MD5 1f28e592d669661e347c621ee1de155f
SHA1 222dfa9666ed6c4dea4cc64c223d60890f5bb196
SHA512 6d76ed15c5dfd4dcb71e8d80afc1ae2dbd646823a5768cbe59977ad5f92edc3f57628920a342b1a93ff6128293f0ecf124b24c74652616bb703774a12f36dcc9
SSDEEP 192:EfPv7+hupBW8jOZyFekEAWcpOZUDIX3eZLf6j1toG184cugmZm:i7HMQOZycpf80X3u6j1to4LcuRg
TLSH
T1D842C03AB86357A0A35E75CC7F00B7C73B7E9281576E806D635848E71016A7FCAE1E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b51369cb5fe2a5d8b57cc826d25802cb634f3a9430cc6a5460d7fd24393f4b07
MD5 6c3fc8c600be5048f6f64cdd05e7ef61
SHA1 19513f53ad660c7465eb68613aa2e46394903354
SHA512 0556cbde9765d1c3a3a2522343062b225a9fcb8b9ec359a9f49a17c7b2cea33b48531f22bc575b457f1e14fac0292977bd706592a380b6ecab8beda0f78c2c9a
SSDEEP 12288:u075fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7Sl:X5fJ4yL/tNCJPXUQrPm
TLSH
T1C54523A761D49846ED7687F8164CE000D309BED51B1BA2E7EE42B4853FFC98A1DBC352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0933e3dcd380c862a557ab2118337c654a855e8e300aad3d2ee3d43aec8784de
MD5 c69ef4ad2257055500c97503a049b834
SHA1 7b2c3dfd25e21d83cf94d7547a4906051faba20a
SHA512 0e2f4e9410ca1323b6a8ae335068fee21d191a2140aa6604853d98a9b12197ce9ed8a6af12472aefc4dc2b8ccd4bbd8da1fb43e0c3ef13a990fe81cae782c899
SSDEEP 24576:qgb6bmBIi49WNNFpg1rSvFv7bYjfJ4yL/tNCJPXUQrPl:qgb4mBIBhGFMfJ4klKXnt
TLSH
T17565AF1E22EC02F5E0F5D2B89DAA4417D6B278160732D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6220a88ff960c853e6bad3d6643cd95df09f6dee298687bc53b2889da64e0a46
MD5 37e65c59e6288f9a9e179fe1e8928af6
SHA1 f2f877e73ba34ddee9bedd82fe597640a32ec662
SHA512 b0ec05fe75d205f636d6fe170b5d582c0356aabbadaa6d1b8789746c8903e8a22b699c48e470558a63230df6dc42969d071304d26cd8940139c82d178b3729ad
SSDEEP 24576:fG88u8FpJqH1bzria7/mcfJ4yL/tNCJPXUQrPF:u7ZFPqVea7/7fJ4klKXnt
TLSH
T16E85026672E101F1D47BD1388A858663F771B8150375FBDF0BA88A512F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6311c095710c6df7af0a57520c65ace788ae8ea38c3e0132f1cbb648d2c6489d
MD5 4107fa62daa520f257805b5fb0384da8
SHA1 07618546dd6f0dbfbb36336cf2d01af69e70e94a
SHA512 8ee92e26bf08bd1820dbbbc005cb90dd0ea02f1d30f269c39aa3a2631f19bbf1f4f085100a9e3d66b08ad7f7bfb493f4b0fabc5706c7b93f8ea2ad862f70cb99
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4fJ4klKXnP:6G05lO43bNfJ4k
TLSH
T157D5CF6E62EC11F9D1BBC17CDAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 607cd0932470f4a51b03b1f6aee3b40a7bd11c966a3809e13d345b0dc998c329
MD5 ca9ddc9cb4da0bc4cfd649aef0d72f2a
SHA1 bd52f68be3f09512b92b2de04ab55de3a8d88fd6
SHA512 99f2bbba98579d9fc2c72eee78f27e4779297bd44cd40428358828c4df5e5ce9c244f7a87aa9f3e6b2e0a7fe7df66a0ff56470d869d8fa2e98cd1dc40dc8a341
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnKfJ4yL/tNCJPXUQrPH:+a5POZ3BJt2pasx2+mgfJ4klKXnP
TLSH
T10765BF5EA6FC01D5D579D17CC583861AF5B1346253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 73258f91517de5a8c64832cd08b5140c4be9ae95eead757c88fbc3703348ae61
MD5 3ed4993e42f0423acff9440c992bfb09
SHA1 c7fa109c07de6502b59746e556dff45eb55e23d2
SHA512 85a02ba92c09cc567cc2dd807bb6b06e0f8101162529e3809c5ddceb2482928ab41e54a416206c61068390d71fda55b8f753589e473922b6ab97fac199c49505
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkkfJ4yL/tNCJPXUQrPQ:WNc/zEOVHFbfJ4klKXnY
TLSH
T1D5858B2623E901E4F5BBE1BE896B9546FA717865133486CF0291811B1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 cdac0a565a90969afd12ad50eb8f9b6bf480556f466e9d7ff3a261807cd9d8fa
MD5 48845adc66a05207cdf4c75b7affaa08
SHA1 d78c7594fcedd82fdc48ab799a77b0013d789049
SHA512 b2a5e852f58a5b510dbbd286597dc57e2025428c0269e04c074adb78a4ebd62c1f541955935444f69a8a669a7ecc957af7dc3c57fea4024ef168f20eb65ac223
SSDEEP 24576:lTkNvNnaFeYhJNtmZBmcfJ4yL/tNCJPXUQrPJ:lTMwBtOmcfJ4klKXnR
TLSH
T1B755AF6EB6F846E4D1FAC6B48D238112E6727861073293CB9390C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 77eb3de2d6e2fa23170e11c2e2ce278dca553ad4b264bceea2579c637e18a9a3
MD5 3d8e44ca3209f959f2f12ae969fcde87
SHA1 a381cfa06c02a239e8f6c9fefeb4c3f4902c8d04
SHA512 20093af0f007c58fe058227d88d6c5392fa064d4d50105e54df8130186a6631a75f89be9d88dc5db35c64945746cc48e09bf745298ef4aea4430afd14b4fdaa0
SSDEEP 12288:qHvUrBFrEjwaQofJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GGYT7SQ:qPUr+NQofJ4yL/tNCJPXUQrPP
TLSH
T13565F16F22E818E5E676E17C89858209E771B8A21312D2DF02D1817E5F77EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 75ce6cdf87b8fe9b9d0a519cb984a91783cc44436699883066324bed7c11bee1
MD5 8dac96a73b6342871704b5736118ef7b
SHA1 cde3ccd1084ebcc269598dec73d8c9ed48c19426
SHA512 3884b953502f4abd575ee4806722054ebe87f263cc0c61fa0d7418a6ee4079f948027f806eab12ab9d5de8791a8c0418c40d645fe40d46d0a35d0528757a1335
SSDEEP 12288:9QcMxWDXN1Dp/fshBItT1IQgA9fJ4yb+QdIKYKNCJKHZDgdVw8XkLavV2Q9yW+GU:RD3FHshBIYQgA9fJ4yL/tNCJPXUQrPM
TLSH
T15A75E17EE69C04E4D57BC2BC9A538506E77138E9032266DB06D0D1B62F6BEE42D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/244-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/244-144-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/244-142-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/244-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/244-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/480-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/480-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/480-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/480-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/480-338-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/480-104-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1500-94-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1500-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2716-344-0x00000285001E0000-0x00000285002E0000-memory.dmp

Download

memory/2716-365-0x0000028502C80000-0x0000028502CA0000-memory.dmp

Download

memory/2716-389-0x0000028514700000-0x0000028514720000-memory.dmp

Download

memory/2716-356-0x0000028502E80000-0x0000028502F80000-memory.dmp

Download

memory/2716-355-0x0000028502A60000-0x0000028502A80000-memory.dmp

Download

memory/2744-117-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2744-323-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2744-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2744-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2744-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2744-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2904-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2904-24-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2904-18-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2904-26-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2904-25-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3408-69-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3408-67-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3408-57-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3408-63-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/3408-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4196-175-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4196-51-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4196-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4196-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4796-78-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4796-71-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4796-291-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4796-72-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4944-122-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4944-322-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4944-130-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4944-124-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5112-152-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5112-151-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5112-158-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5112-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5732-9-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/5732-13-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/5732-17-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5732-0-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5732-1-0x0000000002120000-0x0000000002180000-memory.dmp

Download

memory/5756-42-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/5756-37-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5756-36-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5756-40-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5756-30-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/5756-14-0x0000000140000000-0x000000014022D000-memory.dmp

Download

memory/6024-82-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/6024-90-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6024-84-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/6024-317-0x0000000140000000-0x000000014020A000-memory.dmp

Download