d966ad3db64e8342426d8ee11ffbe8c11e649418eba4e85de6d994b99b0bba65

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
Size 1.7MB
Sample260701-d3pr8adw7l
SHA256 d966ad3db64e8342426d8ee11ffbe8c11e649418eba4e85de6d994b99b0bba65
MD5 a1eaa36aa554fa080513f6cf7e32489a
SHA1 151fde61de632ccfb46ac9404c8bc207a1be9823
SHA512 161ef67ed099d990692676c2d71529b3428c1750a7499ecb1c041c6ed102ca27055a772586dad31e0010ea9b19e3559fc639829212a979cf3426a2a2294b7948
SSDEEP 24576:l6V6/C/AyqGizWCaFbybnQ/tbw/2Mkjy6Fr7g0oo:l6c1GizWCaFboQ/lFTjN4
TLSH
T12585F05AF7A511FAD8B7D03889435523FAB27C050724ABDB93908A269F327E05E3F750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
264	elevation_service.exe
1292	elevation_service.exe
5600	maintenanceservice.exe
1252	OSE.EXE
3408	PerceptionSimulationService.exe
4020	perfhost.exe
3132	ReFsDedupSvc.exe
1932	SensorDataService.exe
2368	ssh-agent.exe
5648	AgentService.exe
1180	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1744f51659cd5fa8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000747181440a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000faaf25420a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000612e16440a09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{2D601E1C-19BB-4376-A625-610FBE2D27F3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{E9F297A7-B105-488A-8218-7FCE5560A3FC}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
412	explorer.exe
412	explorer.exe
264	elevation_service.exe
264	elevation_service.exe
264	elevation_service.exe
264	elevation_service.exe
264	elevation_service.exe
264	elevation_service.exe
264	elevation_service.exe
1292	elevation_service.exe
1292	elevation_service.exe
1292	elevation_service.exe
1292	elevation_service.exe
1292	elevation_service.exe
1292	elevation_service.exe
1292	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6084	2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	264	elevation_service.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3132	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3132	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5648	AgentService.exe
Token: 33	1180	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1180	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1180	SearchIndexer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeDebugPrivilege	264	elevation_service.exe
Token: SeDebugPrivilege	1292	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5644	sihost.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe
412	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1684	StartMenuExperienceHost.exe
5764	SearchHost.exe
412	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3204	1180	SearchIndexer.exe	103
PID 1180 wrote to memory of 4292	1180	SearchIndexer.exe	105
PID 5644 wrote to memory of 412	5644	sihost.exe	106
PID 1180 wrote to memory of 2896	1180	SearchIndexer.exe	113
PID 1180 wrote to memory of 1548	1180	SearchIndexer.exe	114
PID 1180 wrote to memory of 4228	1180	SearchIndexer.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a1eaa36aa554fa080513f6cf7e32489a_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5600

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4652

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1932

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2896
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1548
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2228
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4040

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:412

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5764

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 edb9f79bd54ce7b599bca7f70d9eb313bec0b4136815c5dea8b556376c4cf762
MD5 f142e0153eac72a68787faed22aed83e
SHA1 b8449c69b430117b4f128f6bd7b8ca81fa4b2658
SHA512 a4ee799ceed1de437e5126e65ae5ca87d67d0536d5c71db06fa76a21c1057e8a732d63b78ebcaf1e11487f1f9b5f364896bf9157d2d993357a175de9b75c5855
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxndQ/lFTjN4:S3q6HjBlLm
TLSH
T1D0D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 757c2898015c211d331cb1964afb33082e4db9038bce27d3cd2332795ef324c3
MD5 88b5f8c86fc210e25d7ecc073f0eb143
SHA1 089e0625cf5d88e99b5225a9f7ccf197f1837d7f
SHA512 6d3fd0230fa8bc6aaa171716d761c65c1823e96e2b86cba9b4d117703ab0e2b6326826ef0aa2f04f9a4d7b7d5ff74a63d88997c7f9c21171c5cdb8cd31f2162c
SSDEEP 12288:w1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:mXYfDtczA+nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T11F65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ab917bbf3197ed1681caea4bbdefe71795d5dd318d4b717730b7e3e62c109886
MD5 35463ad71506d6bc7811ed1ab2066199
SHA1 bb7c34f0dd07340245ce8f8c32e7da902c7e973f
SHA512 e0939261685a7205cbc431d8be9af150f2eb9d003750c4ce9fef1e5b582626be0e725e46c4cfad35efb6c522913edd5686249529062599adf9409196249501b2
SSDEEP 24576:T0Le5ji0hmxLrMFnQ/tbw/2Mkjy6Fr7g0oe:TPji0AlMQ/lFTjN4
TLSH
T1F4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3e25b7da7be87b122851f42bfd746d61529bb5f970be7639329969725e050844
MD5 225d698a62d2f4f08b010818d5297517
SHA1 703b6cac571b1bd26eee094445e22e94a4ca8f47
SHA512 da5de8bcb96c80c7e46e9edeb7e160373f0980bd2e6fde39686deda79196c64b524499859c860334d98fdf0cfe9edabe5c938d24dd5a9b3ee04cbdc8fd459aa7
SSDEEP 24576:9a7/ezSC6vUyD/aqgrvWE6q8wyu/nQ/tbw/2Mkjy6Fr7g0ov:0/ezSC6vUzPvxHjyQQ/lFTjN4
TLSH
T1FE755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8bbb08c18a00b6970e8d0080b71ba1d323214b271fe25353ff4f93d14df53cc3
MD5 56dd3e93d469b8345c0e757f562f686b
SHA1 df4c07a5b07cbe2b1c8f88f3ebcdef8c239614c0
SHA512 b0d34fae726c4f90f202fa69b70dc06ce505433c64e991565da244cae145ae8bd6da234249cfca7f8cae9e4f0e5caa234a82691711c03c7029bc5b9cbb014040
SSDEEP 24576:FVbqPb88hv/l+66nQ/tbw/2Mkjy6Fr7g0od:FVO88hXl+JQ/lFTjN4
TLSH
T14C559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a539b1388b8d562a5dbbfbca99a225327801793c40526c9188cc2af303db8631
MD5 53c27f6f7dd3e072aa2ff99264a456de
SHA1 a9f5d232202bfc46bec8cdf4060e318131141314
SHA512 bee3d3d551fdc7eae6d698a29ab050842bdf5b652a4f91c567a71628ffcbfd4adde6407a343b0a0211c0a6edab11de51aa3ab15eb5e0fcecdd82641cc391f933
SSDEEP 12288:3zxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:3zBnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1265523696A24F897FF2B06B55CC284826B7B0EC1BFD4A74E7B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 2a9580ec53dc6287eb701de85ceeae82485b8f091edd80f48223db5825a33f5d
MD5 99cec3bf04ed5f58e3bf2249b1ea0826
SHA1 96aa1f7eb7cfcd421f154a4b97ba5755f19f19b2
SHA512 1ab24c26e73def50fa73d9cfdda448dac0d675088bb2d33ba99bda145df677e6d729e9f8ddf3aeeb66e3a07c13eff515249ebc4bae9d6bc1a696da2d0c6e94f6
SSDEEP 12288:FeBNUbTVO86UiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:FJIUinQ/tbw/2Mkjy6Fr7g0op
TLSH
T11375CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ca94d930321854e66c27bdf9440615a13f7dc9042b01029e2dfbc7593ba93ae7
MD5 8b451d198526ee0b7fa6c50533ed9d71
SHA1 6d83c8d74c88a82fd07de39694d41a6002ddd3ee
SHA512 050cfe4bc2f8a702463852db1b9eb5e27989e8e0c5b4ec9a61cca87669af843cdc4ad615d17d23b64be4c34b5ab78d57e07f53a52503dcdd24275aa2546e2c57
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:KQvGAdlCEL8c/yRNw5CELm
TLSH
T131267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 01789eb94f0fd80c73496375a418c6eeb2bc4e08f6ee134e956c768fba3f8f70
MD5 bca68a803b906bd879474359dece66ad
SHA1 1be58721539cabaa47ff100cd4c96f608ec523aa
SHA512 27baac78ae5beb141f47fffe6d218f303b066d6597de3c77f32aea4befff954d32da4a29c16165b14869482b19036be9d9cea8c92d8f9074f2ec100f6a25c1b0
SSDEEP 12288:DAwSfxL/2Dc39DLLmt0LDQewsAjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg8:8QewsAjcnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1D775E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1d3abd704389deaac3033f07f709358aaf1ede9d9c7ad08cf77b46adbb868e0a
MD5 732d4dfb6ddecac41400b62845b3b017
SHA1 c4d4652ed9fb328f86c476c71495bb211a70a27c
SHA512 40f1248eb80ad00182237f105fbcbefe7b5df843f05be57e052c0cb836ed28411ebfef6a8467c814f02fe28daa0efb9a1b219f1a5f45d7906f6806b105c4d564
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHHL:PUEtQevvqc2W1cpV2EI32
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bc2f298d45d787a9aecbe761b7417904ec573a73d3a9c1da408858ecedc0fcfa
MD5 c0433e05aa3b75b25a3dbf726ef7f8e0
SHA1 283d7d5770a5e0fecdffaaf876a75e390fad16e0
SHA512 acbfb4d4453a33d52ba258a915ad8f137ea32d6e1c360ea632feb0692b913bc0b52edca2b89d01ba41321074917d6038c8d74d78f004835def06d4f5eb33d011
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/z8Q/lFTjN4:yoqtVjnm4Lm
TLSH
T1F5D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f427e06362dca135e83bbc85bc0e195d11ca42ce55934e0b5e6606bf5a83b978
MD5 cd00682468e907e05edcbd0b33b633df
SHA1 622c50aeb9c3f808f9c5b61095d2f66d91ffdd26
SHA512 1b411069b82b104bd73ec291e0719cbd4b599a0862873e7c2df4f075ea651113e189dabd07263a890ea375812d6c7d4232e78b73e13b956d743e78201c265373
SSDEEP 24576:GAhGLJIFoiwtA5l7S53znQ/tbw/2Mkjy6Fr7g0op:GAMyFoiq5jQ/lFTjN4
TLSH
T1E935AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 984934b3260dd28ba1eb0e59244f4419ec654eca767edca6bd3f774e2bb61276
MD5 c2d070d86b19a41d22aa96079c9e58d3
SHA1 7d2fd04540c06f828ff14df4bacfbf19a1cd1b51
SHA512 a54b3e8388af8d55d7c0a5c6e365428292bfca1a50d7781ac63bbde2803a3cc669427771ff2120219529303dfdc22220bf95063bf41a220efe67d3af2a30f5b6
SSDEEP 12288:smw5HEjsChN2BFgl0WDm+C/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMU:JwuHOWwnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T10065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a19e7587a0df1d96c1790234f227b5db15418e26b0e84a4574e374124d1eef28
MD5 d889aa888cae5d405cec24b802bc05b4
SHA1 37507e83445cffba0ed8437d8b894d5a09757612
SHA512 11dab9368433eee14cde5c816ae2809fd9228115df965afae04944f78f10c8eff55ca0b44f7e7f4aaefe90675e9b1b6cba5fc9310bc530d579b0c5fa78cfd403
SSDEEP 12288:+XZ1IysGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:OZutnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T12C55126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 532ff24abb0225ef6ba698ded5afbbb3e122366ed3deb684bc12bccedd3cbb75
MD5 a4a841d99e3c5176ede02c9c91e1e720
SHA1 13123b6e1ae1d1aa850c1875860782c7d3f01e7a
SHA512 199a1a0355ce5cbcd08a41de9132b70b54b06edf3ab0013b15ce919e5175406cf6e25fc61a5b34f93c1e0157f71be3181240514aeae6f76b34d26eac4d9e119f
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:vQRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T14E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 54a8e85c0327b6e8a3f4f841231be722d9ee553be78bf47cf5688eee8d5dc907
MD5 bc8ed6c0975f2c821c2662b3fcb6ada3
SHA1 6cafa5f4f95225df605ec75ef567330fedeedba0
SHA512 fd8e1e1a5de4249788733a3c099e1f37de617224fea0c859b4dbacedf5f8674a6ae15a1ce01b4540a44f5bee5ab75e0dea07a0ad43dd1900eed353103d518e96
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:nQRQyi36YOcPQLvw2gAf+PN3RLm
TLSH
T1F3666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 db3c704d8da45bc28e9bc926394ea712da4a762b6e213eb63a74a750f36bba9a
MD5 eb329a5411d3dc22cc019af107d1cd92
SHA1 9823dc7dc2562aa46d611b68e34735e43c255ed4
SHA512 b1bd393804f15c21d1754b757cf5e9045b2276727af0ef2ccd28493466063413d4c4573f725c15f04be5866a2a7a3b83399e38116e6648535e7c3765da59076d
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dnQ/tbw/2Mkjy6L:c68Qg55nhheWu7PNU3/MQ/lFTjN4
TLSH
T1BFB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9e4a0123a74ce3df665a17ae5eab687aeddf29c33ee01f1dc2984bfb1f67ea4f
MD5 81afe20c239abbc054bc65fb1f3e962a
SHA1 8837ed9d277b84dd44550db379badc772968effa
SHA512 ce48fa4d74e9ef2741254c8af3ea3f550d62222631ee27e9826eca07afb989a237676d1876548f6722d0a379d1e24441ad20d0329ef76e50661c62be9f5680dc
SSDEEP 49152:93aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99i:sy5112gYy5azzVvL69nLKnhZmLm
TLSH
T1B7167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d121ba25e254945aec27600b9550345134164415d9afc5ebe1a6b81cf99f2b92
MD5 895c054e374be076e1a4cab747cce82c
SHA1 c447fee89c437c81c5117eff5ebaebef7f45af0f
SHA512 22337d54f3ca21d3c077d0fd4361e45319c3a3e3664ced8a87d412192acbf32997bb473ec437f71353b6c7965187e06a4bae09538ab9a38d1f3f4cd0bbded08b
SSDEEP 49152:SB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl9Q/lFTjN4:gu6JmVxd2dyLm
TLSH
T1B8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e8bcab357dd39bdb6c41957d5ee2c3293a15d84f5ba76823ab8a86888aed62c4
MD5 3655bc129972d0290dc9a20e6a44c6ab
SHA1 42f85ede4e401b89bcc2a94fbab9f25e9df11889
SHA512 e91bdd565b9bb804f3dc39768e14e0ebcd04b27026dc73cf1312043495247fec853cdf3e4010be214d9551ccaedea98b0a2aff8db61aa279833bff9236d1936c
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xCQ/lFTjN4:DmifPbR4Lm
TLSH
T118B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e3df33e13c4cdfba9ea8d34c7bab461ad14fa047fac5337bfec81dd8731e1bff
MD5 024cdbf5d9f016fcfe3b2a25a5e335bf
SHA1 37e5e7a1563bcd01f7ee38bc0a5dd06680ed6a0e
SHA512 aa369b75028ccac0e836c04a962468560ffecee262046a7942c8532d9feaa3460e98a33c0158b67933132e2f87c01552bd454dc6434fbea122dd53797044b3c3
SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:z5dKTi61iLm
TLSH
T12DC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3cb439e4e7787197227093ca2ace4d55c5887e792cea443b88d0a994315d7768
MD5 f76b3347d447d68d58603ce5c725e4de
SHA1 961cc04ce2f6ce054cdc53395735c88792060491
SHA512 e29a5f5b67995b72543b11e7028ce36c4964275694a3a6a13120ad330b1f562b6f9335e3044584bd925c71585b61fa044033ea417c2daa07a71e8f668cdb85dd
SSDEEP 49152:/htSn8EApI0figngiDn0AP5w+Q/lFTjN4:uX2iyphMLm
TLSH
T17A95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 727f32ffd0eb7453b0271fc990ff1b406f2ad7470dfe11376322a68ed715857e
MD5 3d7b310cabc031d62c0a4eb3c6c42609
SHA1 e24e94bc7765f4958a14f2a0ecf4707db5ccbca6
SHA512 7104f22d72cd1d28f6c0f011485d1edb8a27474b202a54558d6b4313e8daeaa209837f39693efb50f066af2d592eb71b80ee241123ce51e9b5224daa3a5d96d9
SSDEEP 12288:W5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:WJnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T19C5523697965F98BFB1706F18C828182A73F0EC6BFD1A38F77481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f039344263a11f8a39cd4edfc594a9098b72f9172e334ee732b01828b33110e3
MD5 0a76041702d9f34a81ef771b1ce7421b
SHA1 b523ec51094e1aa15620d100377f10e94703620a
SHA512 ef09b610cc7fc4dc8305170035cd98a8c8307cba4cf9541b68c8e966e3554236c39aefb6387bd0886cb9cd70232b7d7dd8bc1a68fc384d319d59c079689bccd0
SSDEEP 12288:8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:8InQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1E15523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0ffd9d323a81679c3292aaa114da8f51d4c0fe4936e0bf759f5a34e9d64bfdc1
MD5 5617a62b0c64aaccdfe2fd0a0d3238c9
SHA1 36c8314edd3607d29b7a435e960dcbc782b675de
SHA512 06ec80b38f37b0885952eec67533723e29981548b818945837b47f2f3a2e0acdf882cae56729ffaf209cd20e3278d2886b851463c88f5fede3ad5375b920c2d0
SSDEEP 12288:UqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:UqnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1E65523697965F98BFA1706F14C8381829B7B0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a1d4931460446b48402a927bc9e2216be36d491ebe5c39f20fbe1c0ffa80f981
MD5 24878e05735540f80b4caee847c111c5
SHA1 bdd5292bab77b040eee6dd177442be6d60a1580c
SHA512 f2ca037c112967684b33862dac39bff8844f576a6aaa65ba9602abbc8fe98e748a37aa175075725198e7c57b2866a4f772f94888a3cf6fe8efdfd4e5b4960cf2
SSDEEP 12288:PVjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:xnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1B65523693A69F4C7FD2742B4CC928142E77B3DC6BBA1A38F6B04111D4E793D419A5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f40c0a483d23f854f4df0ca7863807f515b6ca0c27ed93f62b6dab66958a8dd9
MD5 8a697c47cf8cc0c629ca98de20c3ec30
SHA1 5d52744c5ed454ae72a59247df7dfbd2d82222fc
SHA512 945ac973d68eee97f7e5847d728647ece1b34a9600233cabd63b0ef7a872043ff7eb65cb61b9e19279a4e0888af37af4af8a3deaf238ffc68b27fb8ba2ced977
SSDEEP 12288:rbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:rLnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T19F5523697965F98BFA1706F14C8381829B7B0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a411332360f83a99ff7d4d02bd629c0be049ba9a69ea8dcf3b6df4b10581540d
MD5 3c0ecf51e6e51e91d31badc7c44a7e86
SHA1 7833fa0c0496534f3b155fb0c53f1dd3e6dafe50
SHA512 8effc53d46fd8cf7b8871a85e53b9eea51162a3ad8ac79af6a62732069cb909010ead3d0ac797eb425c9430a93209ee435e2f4b00e7bf903dfb6713ea30d708c
SSDEEP 12288:HEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:HknQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1105523697964F99BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1756614a3082621b1ea4d554211985d783d3688e79e762e1eac1ada8a611116d
MD5 6420894dc7d1e9339d9f570923ab0331
SHA1 b80b0bf1bff6e41586a7f4db3d435ab3cf4000ed
SHA512 40fcac80f02db8ca3434b05cb766c3256e8c56d92858dfb56b697310527368eb52422336856e61a592d8b2637f38f330557864aac5caa6d526455230fcaf401e
SSDEEP 12288:TAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:TgnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T16F5523697925F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 798cd9b2a7650af3d44fee5c26dc08024d0707c21c59014c2e57bdbff3b6eb83
MD5 41a4e995d3b272e8e57abb254383ad0a
SHA1 997caee6f28b54ba0a77bfacd5991adfe31ae5cf
SHA512 778b7ae87cc82d24473af8fddbc46b387b7d2ecd2169dcc2ef672c02562334ad09205bacdb86b5164a02d983f231828264dfd9714da64d38ad12100df5d80b52
SSDEEP 12288:EiZwbDzzFEoS2cPvyoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:nZM3zFVSOonQ/tbw/2Mkjy6Fr7g0od
TLSH
T1F27501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 82d51b7c526a1596c5b9e2cf83cdf73f5149d90f86bd78ce3847b803736998f4
MD5 ba80c4089d0054da8c149d2f3db422fe
SHA1 955eac864f36aabf4a61495bc69e4f0b45018ddf
SHA512 932ac2d599b90ee929fa2152c0d3d5fe23da5ade9411b31cf147c546b67a7b28e9eb3844ef808770a90416a98053ae2d1a72369199a7c9e7cdeebf4119841034
SSDEEP 12288:IdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:I9nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1995523697925F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 4e6854099afc5a0b27e02636d2f8361a3ae5819dee9c1da4dfae878bc774eed3
MD5 437bf98d0ff7a790ee14ba87886f285c
SHA1 7722f74b2632f9da8f228427571c12c3529e0ab5
SHA512 372972969534ca3f5399d94caa98dcc6ded2d79ef751e0cfd15d61478bf2421b76505caa8925a3cb536ee4950712c30afa58e535f520f1eb466cf7f0beba9d0d
SSDEEP 12288:IBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:IRnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T16A5523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 176736014233193261d0261d9dec910b4a478833f7dc60b14f33039e24c373fb
MD5 d4d1545d573a30602a8111f42d314518
SHA1 f8fd8d35df4aa7bc139259354673bb5c513c7c13
SHA512 59bec73e243664fea3a4ce871803dc47a1b2605acc6dc9cc1fed6ebc1fe3b64e978d6aae2369f33de79f430ffffabfda03994785c22ea2d71b20c8528ecbe93e
SSDEEP 12288:GyPz5L8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:7zysnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T16965021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fdeac6b5b7f531a3da11e903fe6cfa7dc348746a5a15c1bb73d54b842d73a049
MD5 6a107ea4270f45ace69cd56fe798334d
SHA1 2be9485f1f8b04e8e3b71c03862ee656c69c3b0e
SHA512 e39465e4c1ee91aa63ac98e052a630c37b6566f0833e4ee2116f0ea1153ffb8a9cb6e5c129081217bebbcac4690b37fef9922e51d74e8729c45ad392159ee531
SSDEEP 12288:cdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:c9nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T10B5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1a45e0757256ab406ab463378450fa7a479bd68fb8612c473a5661a1321c2fa2
MD5 43f26278406d70778a0c3a9aed958c5a
SHA1 32d225ab99cb67ee4e1973c21605d403e1c56db3
SHA512 e0ed20abd48b881348f0e6e8fcfe33a4d362f1eba86a268970aa9ed4430d27f28712d98bc1df6ab979eb46d545387abbd8a6beaba191248622e444d2a59a32c0
SSDEEP 12288:AdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:A9nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1F35523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 488e6e4c5fbe614c4c2aff8f904448fa5b0948c1cf01e256c943ae3aea51a635
MD5 098a4af47808a94a13b6a59decf733d2
SHA1 067bd944399aab6552b886a8602c187fe18d6dd2
SHA512 ca7eb0d23fa473963c74bbbb2259ec639cca25663cc86f4135d6921d38c9168cd2294589605130288c2dcc26982015c4d6bc401c5be0b73ffeccb7658e0563fb
SSDEEP 12288:HyPz5L8sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:qzysnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T15365021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 687e1cee5eac262997832cc91c776ff61c56983fd63f659eb3050b36c4c08054
MD5 d814fa3e9c7781c0bd5384614e997ddb
SHA1 d18de2681469bec9e9d8e478c8811eec4abaa5e7
SHA512 d592158b8af3d7b09a90162789ec479b3f83bf0f07442261ea9b90da2c443772de2688939752cd76d3b766a8237d16872fb643b1627cae4f706e0b2f8e4025de
SSDEEP 24576:GT0aLl3z0zDanQ/tbw/2Mkjy6Fr7g0oj:GTDLlj/Q/lFTjN4
TLSH
T1977501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1fee5146595105ee89ced74d709d9d89620159e9b04399842ee69651a7618ba7
MD5 281900e8fc59626934e4f3b9858d824d
SHA1 89912a80960333cf6fcba931535d1be93c02275e
SHA512 d6b62bb774513fbef77032330f5fed8de26f5f12a56fc76431ce6d6df5be455a545bfe7f2be98ba20b4707b4a1bc3a2c7ab61a489538a51feec50f437b247304
SSDEEP 24576:931d9CHKy7GZmnQ/tbw/2Mkjy6Fr7g0or:d1d9CHKya0Q/lFTjN4
TLSH
T17B85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 570eeea3ba5f4c5b6d31c5f3a3304cfe3deb79c33aab9d0df57a5625d9378502
MD5 dea7abfb616d10089294562376cb9269
SHA1 8eedfe395c637d1edb9f65eb8c4f278f44ecee47
SHA512 1ff9d1fa817b7f330bb58a5b5c675ed5e16c2cbada71bda530b6cdfc07729726f8e4084e6ce44d1986d761dbf680980acb24eab4f495c250b4c20eb72b2832fd
SSDEEP 12288:jKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:jKnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1AE5523697925F98BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 29d68be282e934e974fecffd6842664e6c9208d8b22ecda8f693f6ff67884882
MD5 a87de45d257938055224b57df2ed13cb
SHA1 d0aded2ae447a2c03b6b3b0e58db39c183ed18d9
SHA512 060a0ceb9d73f4eeb11fbd1dd6ab8e8a4e11ade94e8a3f3af4ade87d0a656329ba47a342f68bf9d690df8e6e1cf99a77614bab1c5755d91214a790c49f854607
SSDEEP 12288:mMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:mMnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T12B5523697964F89BFA1B06F1488381829B3F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bea9d97e85c1942ae359c440cef8d5635ad8700e1009510510360b2fc198098a
MD5 f5ce03f566c804bfc8c159390cef8aa4
SHA1 1786ca2823e105d37e5eb9d8ebc6facc9e06c2a5
SHA512 e677d344dab94808cc66616cad54bb9f45dc0c787822d226e86f726fc45d54cd99dc20e410c7ede8ec3b4d2d1a19a26b8f4a2dc992091abfcf8e05df33412328
SSDEEP 12288:8XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:83nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T13A5523697965F88BFB1706F5488281829B7F0EC7BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c70c6640cb0c03b0a0830a89c78e455345022c60054e3174a1c33198fa24b5b7
MD5 6d990bae8cc2faa4b01ef84d15124eb1
SHA1 be6402053f7337f8aa5753e67635e6811f1f4a20
SHA512 9e01c6e2ab33ebfedcf8286c31e4947be4ea04e66555ee2c6964e286ff9eaf052531f389ba03aa2d9da1d7e9cbac29b20ba8068bb610cba6a6508f877c7aa0bd
SSDEEP 12288:kdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:k9nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1A75523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1ad9c74bfb5efb33934e9883b0a940ef17f43deca5c2b607e32c0c775bf2d4bd
MD5 45cd2d431e571a785b2bf6797c7586e1
SHA1 10db378aa5890c144c02529c99edb2617457ba2b
SHA512 beaed583021b0d43f7e4cf8cfcf0e8fe7c44a237b0010cd5fc33e00f15ad6bc834b501ef436d0df582bea9cfbc91b2d31c28d3efb0bd4e5f98b23f64d4752da7
SSDEEP 12288:NKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:NKnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1A55523697925F88BFA1706F54C8381829B7B0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e6ad22a314c797252931a564568ced9fd758bb0d337c119f1841f2c165df9545
MD5 228cf0e6353eeb2c48652ccd26ed3c85
SHA1 ca3acdcf4989aba3c91f69e6a75b0c7a2129cbc1
SHA512 cca38194c054c68daafbd86fa84049d5fc9107e70b1e38d38ca4293b865d73d116d326fb35d3ab1b653383ed1d0d683afee25b66518171516b566ebcd663eda9
SSDEEP 12288:4VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:41nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1255523697925F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 4d201270e125fb331ce05765a6011d2cca07ed3b317c85d50b5e91a22ae352a6
MD5 c03532bfe790e55ac06a053fcba9d9e8
SHA1 39762c74e92bad1f8f801d39e3cd68d39e39315a
SHA512 3bc95aa68ed2963504b077963deb91f7f35cb96b90535c097a39c2dd3ee941714f146739cd63aee024c69a1a16ce3d63d68aa79fe8ea56b8a9f057361432ecc4
SSDEEP 12288:2bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:2LnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1AA5523697925F98BFA1706F14C8381829B7B0EC7BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 61244b56e154adffff5a3a79fe8cc204aa0e955328488b343300c44df18a6129
MD5 2e5a2ff4a8d18588e7461925aeb0c2f4
SHA1 3678ffecf48f756685ce35ccabf4f5f49ca4fe16
SHA512 201f136fbae3826f1cd0a589796f4b8bf64fc3f3774117ed4355f24c643a8eb537a06a6bf4753b56058e78b92844c42aacb77bb8146d648107285ec5e67bc90b
SSDEEP 24576:dfwv/k9RX6wkyAIhnQ/tbw/2Mkjy6Fr7g0oQ:MMnYIhQ/lFTjN4
TLSH
T12685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 04f90b35cd3fadcf7481c1773fd4ef2258c4a4fef18e18b6fe8e22479d3cf9d3
MD5 af1b137c877cdf919e66e0a110015032
SHA1 d7a259d948d0541cfb1befb096a9de9c912c4f32
SHA512 340eb5cdff5c74755775bb22a0265c794e28fe07ab71c1b55090ca4fade9238e252ff0bcf9082474832e66fd495a212266cf4ee6bf01e212c4e47b2e1e6a280f
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:lySzPxLm
TLSH
T181066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 73afbf11bb3d1d98133c03a4312c9ec2e70b47608802a38460e0d811fa81c8d6
MD5 76715a3c64891f3047f0a69f7d614811
SHA1 c067b9a993b9e7191ae149937e680ce0f34ccbe7
SHA512 ee091437904920f39bb54280a271837cc1a9b36ae425912a62a10a8785e775a401d23d30929697c1e84b543e6f1e73ab3ef9bf5d1705863831dcf9544693b6ab
SSDEEP 24576:c47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY4nQ/tbw/2Mkjy6Fr7g0oT:c47JUQj1irIhCnDHUPfF/uQ/lFTjN4
TLSH
T14B65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 062707ecae7602de5d2a6efef5a0ebaa5dffb2c386385e046f59bd2c6f986576
MD5 6fec394ef8a5f8b89a2a0a25cb832c19
SHA1 a4d230d4d61b7e8d7142aa557bf51d01af264d53
SHA512 df6614a1e82fce7e7811ef19df106d7187775c15f665674e05a7278fac314940b46bfd15050b28fa88193a0ac8ee57cf96ab6d153f7cc27338b3d26298ccb75d
SSDEEP 12288:xssfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:ZtnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T15E65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b94a84c7afbca813a57cd56cb98841c4c0d1eeba06dd4fb6584c045b4142bb1e
MD5 7d129aa2276f65455b627167aecdd0f4
SHA1 22c0b41a2a5f56dbed7bf18b9af650de23523579
SHA512 70595a1dd7e3ddbe9dc511271357571d6236c3049c7577380d1977de495507e5b1f14e82a4d4ef3e358fddeada41faeda2e5d3998091e298d59ef4d1ea039003
SSDEEP 12288:J67FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:glnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1065523656668F94BFA3B06B048838111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2a64b36178b4595fd154b3f39648838947be4aff859790e187ab5876284a823e
MD5 f992d7b0d93555a5157f585639a53960
SHA1 31dd3d38e084d9035fee3a328113bc902e1c1184
SHA512 4d590ece603ae85679840563ad28783e96aeaf3d05f8d9f54e0ddf538e37b8b89673ceb7de13af02910e169369d2e922a6e6636430eccd8cb972d5764f092774
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bY/nQ/tbw/2Mkjy6Fr7g0o5:0gb4mBIBhGF4Q/lFTjN4
TLSH
T1CE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ce6ccb1e6183bc5ce150894afbcd2aff8537c8e8d2da56225a0f2ef366a05d44
MD5 971d611633fdf423fac8110823c3ddf8
SHA1 24f564d7d3e72b533a6f326e413307fa150d40a3
SHA512 a993f8cdda8bfd006a909b630a850c36baf817de21d011cf31d09ca3b87c7dea505ea07da94896dfcac2d94d7883a3eb9b73139677de61d7979bf59f82bf7f80
SSDEEP 24576:8G88u8FpJqH1Qzria7/monQ/tbw/2Mkjy6Fr7g0oB:/7ZFPqVva7/XQ/lFTjN4
TLSH
T1D085F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 93bd8ca655f9fc89815b4adf42cb4c95334ad665ff2835f4929cc86849f1cf04
MD5 078055664c3d5f70d27fe4a07c3c6261
SHA1 0575bfdd67d32510d9f65051d23fcb590639a4e3
SHA512 f2492eccad35d18a171d51dbefd5fd63fbe5a905234cf41e3e2926a589f3c2557195e550207cd8f8c03759287b8a0abf89197de3ced09060e0340f04e5a742da
SSDEEP 12288:dHvUrBFrEjwaQUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:dPUr+NQ0nQ/tbw/2Mkjy6Fr7g0on
TLSH
T14D65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0f1127ab1b21c37c45385853ae408e6294d08ba1acd208047c2cee91f24d61d6
MD5 1b5f6eae4c6b7f52a02b1b0e82a27b76
SHA1 9e164ffa74c8ffcc14246d8d326f42205a317c9a
SHA512 216d09c7ce06d162d9d333ca51891d96339280e37c72084b94b073fe52ded2deb2a7adb1d2ea214c55ad2cacdc91965691cbe3aeb5fab0fa927c0e2975fb1b4d
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkQ/lFTjN4:6G05lO43bOLm
TLSH
T13DD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bdd6d35d75264c4f34de173b51dbdd82edae37a0b9d41431244bb15d6ab6f6d6
MD5 2808bcf3f1f9dc12afeffd7790b6f3eb
SHA1 c806b4cc019080852ef879ebd891d82959c876c8
SHA512 3a4731aefe30431fd0cc035820619f7d8fe65815f15f44c952328778cbfcdbac6869ad3681c94a951246d7de798f7458fed0de179ed813be7d6bbde5672cb7b4
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0o4:Da5POZ3+Jt2pasx2+mMQ/lFTjN4
TLSH
T12565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e68e45f5a44d7e3dc102f223e6c9646bf3f1ab62d79b5913da4f1e0b76318871
MD5 e494709af7a191da2eaeed3c2e4a84f6
SHA1 9680d6e39a7c70768ddc64d2d48f7d2232f6da2d
SHA512 f83d8841ffce80006cc38a4cc98586aa587f6fa7e8bb995592bb8f50a16768120cee436a986592b13d66aac0049be78be16d1ea8550fe54610dbf478c1f60250
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkQnQ/tbw/2Mkjy6Fr7g0oT:pNc/zEOVHF3Q/lFTjN4
TLSH
T170858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 8b95067d66306c9ebab6e82704753d3209a1f6711d0c681bb111ad2c2c89b6d2
MD5 a35df729bb0f04a1c1ffc0239ae1906c
SHA1 672b947c1bb9dfcfe02e59abff721439e4737a00
SHA512 68fffbc2ef867c09a05608c712d1e4fd89a3c1989b7ea79106794a52da4f5e8017e5486350b26912011fdd067c5d05af56fdc268d68dab7b5447606ac3d57eda
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmBnQ/tbw/2Mkjy6Fr7g0oD:F8MwBtOmBQ/lFTjN4
TLSH
T12555AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7d888a04018c56dbbc783f1486ca2fd17a93d1d50a37978064d3ccec9668f319
MD5 7321830c034b15b9f0349bc217f3cdf7
SHA1 05545aa2afd88a0ab4a104fffeb4636a51603e59
SHA512 88d3519addc00b5c79ac9f9250a3f2cca01cd1abbca7bf8c8c0060daaf7f3589b77e8910c9bd921c42b07ea7c4e47d35a1edfa783b73698cf4110dceb46d43e3
SSDEEP 24576:mD3FHshBIYQgApnQ/tbw/2Mkjy6Fr7g0oF:mDVHeBIAApQ/lFTjN4
TLSH
T12975E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-24-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/264-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/264-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/264-17-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/264-25-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1180-494-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1180-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1180-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1180-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1180-493-0x0000000003030000-0x00000000032CE000-memory.dmp

Download

memory/1252-65-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1252-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1252-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1252-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1292-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1292-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1292-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1292-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1684-496-0x00000177804A0000-0x000001778073E000-memory.dmp

Download

memory/1684-497-0x0000017780AB0000-0x0000017780D6C000-memory.dmp

Download

memory/1684-597-0x0000017780AB0000-0x0000017780D6C000-memory.dmp

Download

memory/1932-490-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1932-447-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1932-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1932-111-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1932-105-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1932-492-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2368-118-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2368-480-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2368-124-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/2368-116-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3132-512-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3132-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3132-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3132-93-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3132-514-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3132-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3408-77-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3408-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3408-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3408-284-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4020-82-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/4020-87-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/4020-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4020-285-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5600-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5600-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5600-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5600-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5600-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5648-138-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5648-136-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5648-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5648-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5648-130-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5764-321-0x0000021981C60000-0x0000021981C80000-memory.dmp

Download

memory/5764-495-0x0000021995B20000-0x0000021995DBE000-memory.dmp

Download

memory/5764-290-0x00000219801E0000-0x00000219802E0000-memory.dmp

Download

memory/5764-304-0x0000021981E60000-0x0000021981F60000-memory.dmp

Download

memory/5764-302-0x0000021981A20000-0x0000021981A40000-memory.dmp

Download

memory/5764-335-0x00000219942C0000-0x00000219942E0000-memory.dmp

Download

memory/6084-0-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/6084-15-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/6084-13-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/6084-7-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/6084-8-0x0000000002130000-0x0000000002190000-memory.dmp

Download

memory/6084-1-0x0000000002130000-0x0000000002190000-memory.dmp

Download