535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe

Analysis

max time kernel
131s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
Size 1.8MB
Sample260706-lpaedahs2q
SHA256 535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe
MD5 0bd656d6c9181cdf6d9bdbd9ddc33965
SHA1 bb231bdbd8041bc38c31247a710adb32b86abe5a
SHA512 7e60b758d222a9b0c9f99006eee25f49811e9101735e908c530108c98bc1f35c2df35ea767d5347da4ccf91e0a665a5f3becaf3b1c4efb494358358025b5fd9e
SSDEEP 49152:0o3GnmefTNeDe0737RM3fDruVeWnmO7qS/mLHxbc:0sGjTNeDe0z72fDreeSZ/shc
TLSH
T19395230274E28460FAB20F3055B846B2067DFC710E756B9F53E96A7D1F389C1A83976B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
3276	elevation_service.exe
4764	elevation_service.exe
2528	maintenanceservice.exe
4552	OSE.EXE
2424	PerceptionSimulationService.exe
4356	perfhost.exe
1880	ReFsDedupSvc.exe
4560	SensorDataService.exe
108	ssh-agent.exe
5004	AgentService.exe
2996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\locator.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\AgentService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\vssvc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\dllhost.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8838fe11a22d4d5d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\System32\vds.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\wbengine.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_ar.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_fi.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_pt-BR.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_sw.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\GoogleCrashHandler.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_ro.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_hu.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_et.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\GoogleUpdateSetup.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File created	C:\Program Files (x86)\Google\Temp\GUMAF94.tmp\goopdateres_en-GB.dll	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e2665b92b0ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000014cd3fd2b0ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005838d6fd2b0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000016481ab92b0ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{65695E3F-27B1-45F7-8CD0-575EB89DF194}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\NotificationData	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{016D8B26-00A0-49A2-A3C0-B9D5D3F3DFDC}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
3276	elevation_service.exe
5376	explorer.exe
5376	explorer.exe
4764	elevation_service.exe
4764	elevation_service.exe
4764	elevation_service.exe
4764	elevation_service.exe
4764	elevation_service.exe
4764	elevation_service.exe
4764	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 61 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3692	535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1880	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5004	AgentService.exe
Token: 33	2996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2996	SearchIndexer.exe
Token: SeDebugPrivilege	3276	elevation_service.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeShutdownPrivilege	5376	explorer.exe
Token: SeCreatePagefilePrivilege	5376	explorer.exe
Token: SeDebugPrivilege	4764	elevation_service.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
980	sihost.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe
5376	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3584	StartMenuExperienceHost.exe
4848	SearchHost.exe
5376	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2056	2996	SearchIndexer.exe	99
PID 2996 wrote to memory of 4108	2996	SearchIndexer.exe	100
PID 2996 wrote to memory of 5548	2996	SearchIndexer.exe	101
PID 2996 wrote to memory of 2212	2996	SearchIndexer.exe	102
PID 980 wrote to memory of 5376	980	sihost.exe	108
PID 2996 wrote to memory of 796	2996	SearchIndexer.exe	115
PID 2996 wrote to memory of 5148	2996	SearchIndexer.exe	116
PID 2996 wrote to memory of 1404	2996	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe
"C:\Users\Admin\AppData\Local\Temp\535fa259b01db41e5312abe7ee7e24aeb1f3a3bf1f884dc938bc380433beb7fe.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4356

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3865087520-2734723108-1233268525-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2056
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5548
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:796
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1404

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5376

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4848

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a78f87b82f5bf814ded347a48e64f2ee5d345d5cc69628d33ea7ecb2764d10ab
MD5 e7bd3b7c46575c9413106acd10870a92
SHA1 6a034cef6faa300a974f99a3df59c8d5e4c4fb44
SHA512 eaa83e056321c3dd38cd85594d22963d3a26cc6df679855221ec86ede1da49217843b2dc85ecc658d91e82c6319074f1788bcd664895deb4c81200df24cb9346
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCmO7qS/mLHxbc:P3q6HjBvZ/shc
TLSH
T1C5D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ae568cfadd034b02b49893084f4dddc3a41ae8101dc817ce2c96464117162123
MD5 30474c1f715eb5d24762ecc09f5363c8
SHA1 66fe248dd3d1ab4be8c5ea0b993d1ef1d97fa6c5
SHA512 776215678305eac92ac0bc13b0d757390ed6672ad0ea58c41df350cfbc9fcea6485757c178dd43f70dbbd039c051cfcceea24ace0f33ec50afc3eeec51f49945
SSDEEP 12288:W1XLsswWkxy2lRq2czAcMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqm3:UXYfDtczAbUjO7l86h/GaYBBPrZNxbc
TLSH
T10865012977E408F9ED67823CC9A18512E672B8954760EB8F03F49A750F332D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d5ec6c4c58eb2fbfc45194eb9256d4d78402f4a53dc671e109f57d77757f1ec5
MD5 c92af9ed26ba2836c4fc7c869d948c17
SHA1 312527028c6047ed0ddb5b4af0200daf8641e616
SHA512 0968db88dfd0071df8df20e64cd53989932a6a3cf55110bc4169cc8540f7cd12d0eb2cadd9f81644304417b5e0be3f7cd00b9979e07776e8e1b2e6aa0a3098d0
SSDEEP 24576:x0Le5ji0hmxirMKUjO7l86h/GaYBBPrZNxbc:xPji0AcZmO7qS/mLHxbc
TLSH
T1EF85AE16F6748335D073C0B9C5D2A69EE97130865B308ACB4286D77C2F6BBE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 16cd86ca94117c24fb3a92a3b563e165d626d268ac256e9581c3ae141827dd5c
MD5 5b40d99edd6ae2998ecf3223f261e5bc
SHA1 4dd8395602d91893fbe530da6d4cfd8de312a33d
SHA512 c30cbb115bfa3c4963566e14dfa6bba7ff37cc5fe62067ec270170d8381216583dc0722f86f49205cec7bc37a0888eb29c69dd3f0367d32bef70aa01d84f15ef
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyu8UjO7l86h/GaYBBPrZNxbc:N/ezSC6vUzPvxHjy1mO7qS/mLHxbc
TLSH
T1ED755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9789946ce589413aeab87fd125fccb3506b5f4d49282c79afb51f077a1b4a551
MD5 ee5ef1b35a1fec4cde47abc1feec3477
SHA1 56b0f005d874f7b642d67b8a3e612757b7fa5367
SHA512 07727d000c3d8c3bb4f959cfd59c95642fb146267387f725f6863ea9dc27954550dd747f9fa8a7131c0823d2f81e03d7e8f4ee2ecb827669a82d4bbfe5cfd96b
SSDEEP 24576:VVbqPb88hv/l+6/UjO7l86h/GaYBBPrZNxbc:VVO88hXl+mmO7qS/mLHxbc
TLSH
T12D559E66F5748331D073C0BAC5D29A9AEE3230425B318ACB1246D76C2F677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 003742bfa9ffcbb579a3842545d85bc17a44f8e93536c977f3f8c32f57df8f35
MD5 7f6b83c6688835a49591c528b9ebe1b5
SHA1 d24b067235279d20e361acbd6a0e8090e31dca33
SHA512 595572f881cc7bfaead7662f964d820166869f2094fb9becb072de32244c3b9c23ec2e8e0367c47da383d7a87563f678809f0be08057aa0dd6b85a858fb7e95b
SSDEEP 12288:aRdMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:aR+UjO7l86h/GaYBBPrZNxbc
TLSH
T17D452317BC5448C5FF0A8E71F294006B40E0A4B99E16AD0FA3B9BFA4477E4E1F47E949
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 b0f0fdcfa0f44b063b9ad58f390438e3a0719eef2e5bd730f82a1263ba959484
MD5 b95d470ce0a0ad4a786d2b1360cd71af
SHA1 8bd6aa0c059ab426a8c1c2907390492a3e49f2be
SHA512 a975bc30b0ee65306df87da3c6f5f2f8c73bc971d158ad354ea40ebf00f74b5123cef90299e1d35042a1920ea7ec1a104d51117e9367e48a5c072e16250d317f
SSDEEP 12288:WeBNUbTVO86UYMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:WJIUHUjO7l86h/GaYBBPrZNxbc
TLSH
T1BB65CF3BEE28ECD2C67A8DB956918200D7B274704F62A3CBD175830ECE275E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 787f6659e8429b80b6c2b256c020e7484fe242a32bd6adccd56ad0b231483585
MD5 95bc66eb2f6b4d8b56a38b9e8daa43b1
SHA1 93630d57ea13467295664a4d6ddaf1685652c135
SHA512 8b2ed42066c0fb8ed82919bce34eba305bff4a1b171e146ee9bb70ece7d6d6e40e3326e607f8c9feae01cce51bdb7d4b0ea1069fa2c1bb1c8638abc158f8e699
SSDEEP 49152:0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THN:0QvGAdlCEL8c/yRNw5CMZ/shc
TLSH
T1D1267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 6a6fa5d2aa29509d4ff607377ea56b868b9f7cc5c408f933e67b5df8ea4d4b1d
MD5 caa833c655f8bc0ff31ce42af9c8f5a8
SHA1 5e9e8cb99b10118132837daa0c2ef294fd31a70a
SHA512 aa685892fdf1a4f3946f3f148532711149b428b1294675e54644fbd1dfb7c7f9c10550bf3432904ec570d8a2352904d21aae24b273649a48a099c293cc79b0fe
SSDEEP 12288:5AwSfxL/2Dc34DLLmt0LDQewsAjOMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JU:qdewsAjpUjO7l86h/GaYBBPrZNxbc
TLSH
T1F175E031FE74D436C77B0DB21B25C716146CB9604F522AC3E3A89E9D4A342D2277AE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e1ac33f6f0fb403e24c79c35ecc937936ae5e7d4c89b6700f000f387916da0e5
MD5 55a596840d80e7278cdfea5bc68957d9
SHA1 735a5f39d14b3944cd2c1d7db0e3f6d8615a98c4
SHA512 9f5b465255871ca57bca879b2518f40a72f7c1d4fedcec151c7a61376d2b53b07ac8b9a3f7f3742851908517672e7b89584c92f0b9218a5066d87cea75a1d471
SSDEEP 196608:pUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHrshc:pUEtQevvqc2W1cpV2EI32
TLSH
T1F6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 97a78c306f2ee44964136a59cde2cd0622722d5d90c81e3aa95463dfa46ca44a
MD5 c97acbf987d7aaf238706a6204f667e3
SHA1 4388d5393f8d1b68b4cf0a6a65329824f56a18d5
SHA512 ff88f6587a1f61ab981d0304b0c63c4e309e4e817385e69c2d01707b719dbdfe8557b046041d8c0d64db7248e9275bae13919ab21966ca0f40b3bd9938606e28
SSDEEP 49152:LCbRquA/m2yL5zQfFiV+XenmE3/zJmO7qS/mLHxbc:UoqtVjnmIZ/shc
TLSH
T119D58E0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 589856f06ea08cff3ccb5ddbc279b28aeb90b9356eb7448cb783be55e2caaea0
MD5 10e2724e4d75b87810aa5094e77b5419
SHA1 e41b230a02170c25ac6ccc406ad0d30763587ca8
SHA512 1fb17a781b4b362ea651ab73e4ab8a1478385c431680702924302a5fc86d5d07ec3d291e92f1cfd7ad260fd5ff0a7fc1d3c0241a2fe0a77d970d285f0a27f49b
SSDEEP 24576:LAhGLJIFoiwtA5l7S53oUjO7l86h/GaYBBPrZNxbc:LAMyFoiq5YmO7qS/mLHxbc
TLSH
T11735AE81EBF945D4F5B3AA7899B68171EA76BCA65E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d20adca507f4c0d2d840c11ff8fd29f1e0ca7af20dfcf2ff164f1ae74daf7a42
MD5 1444d45b6fa03ccf891f048f93a5b484
SHA1 4a744009402ae157a76aa32563353fa2d080d1b6
SHA512 c44b8a3784844fd444d59a4008b210ea036032dfaa12f2054a99c69cb1ea0296a329562c0e6dafb86eb54bfc1135f6abeab1574d0f84f891401d8e445833987f
SSDEEP 12288:rmw5HEjsChNVBFgl0WDm+CXMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYj:qwuoOWVUjO7l86h/GaYBBPrZNxbc
TLSH
T1A165F14676A40CF9E9678639C6978136E3F2B8112A25DB0F1370C75B5F37261BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ec82a3e91ae8b24fe232a692c2a98ff8ed71efd35fdb0c924354ccda8bfb9a3b
MD5 fbeeb54bcaf7c0b4307633b92e4c2608
SHA1 6f5c4e25189abba39f91306f05ef7ed37eb6ac7b
SHA512 97cf7c93df90e2878b578c3295e68fad87c305f4a2651380c7dcb4c85e177d34d5807cd34f61b492a129720f3a6ea6dd30b319a7ea468de20499b480838832e6
SSDEEP 12288:JBZ1Iy+MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:nZuSUjO7l86h/GaYBBPrZNxbc
TLSH
T14E55235A3AE420F9E6578679D9E0020BC3B070A6673657CF137947A90F37AD26C3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b32e15de27970378bc3def9aa5ce6277b6086fdbd3f3278d489989be818f6a1c
MD5 8a32ca7083d660092230d71dade3e64e
SHA1 6500e3bd7bbad833d914d677bbf895759d5055ce
SHA512 256fe9298beb8c321976058387663ba8e9c8f4a56bd0d9b08fadc729a9e998f0d7287c8f9578322087160dbff77b6ac43df062a6d96bd8de0af42b4e5ff79250
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:gQRQyi36YOcPQLvw2gAf+PN3DZ/shc
TLSH
T11B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 adc8080457f681737d4596fb24afb865e6047904444879b174faaf9c0f7e1101
MD5 dd74aab42f4294df08be37a753695c68
SHA1 d13a73d2b17d4890452a0b7b7e39d02700f10205
SHA512 26a5feab91f8f326c3994640eeba79df4bf6f92716895ab3bfab1c6f9f6f4d3f19a2af45b8c66a6c601aa35e5fbc27b58fd26a17a9cf3a72a2ce1e129b7efed9
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:yQRQyi36YOcPQLvw2gAf+PN3DZ/shc
TLSH
T184667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e7f03f18c0ba362cbf16d2765e8febae96babb3fa2628e042a8cee61b5c71420
MD5 d2a05a94a0352a448f3e70baeaa3cc7a
SHA1 de395b6d8620e5b8c5d3b547cdc1a494358da8b6
SHA512 b65696351f0b1099d419454decd3443f03a7b243c8a4deadfdcb33ae37de64151e727bb4baf75bbe9d9e39a04d832670183438221a6e64778a3c366be28de97a
SSDEEP 49152:N68Qg55nhheWu7PNU3/ZmO7qS/mLHxbc:LthWRc/ZZ/shc
TLSH
T173B55933B2F200A9C44DE1769F4A873296D17C758FE1E3DB811572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 914f868d707253d10f04b001dab800af13f853f6815fa41087509e3c146cddeb
MD5 410f2f198ed2e5ac752e8c43c1324212
SHA1 c93b489b0bc5adcadf92d33160b36954a4ac9a32
SHA512 9d0fc5a2b4485fc9706533fb035284263c90f2f2aa3d420b5c35cc099f752f2c82015e341b5a047260a71efd29ed5ad8d6d43b33fce81e40e773d71fac8ea5b9
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:jy5112gYy5azzVvL69nLKnhZ+Z/shc
TLSH
T17F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 73cf75b395d0542b57274b455a1ae5643462668e741f6aae54efef5cce1b5960
MD5 5428c672f0eae443064beff75b239d8d
SHA1 d846e55775c659035e7be28d663ccdc61128dff7
SHA512 075e02cfbec92e11a1d2f463624d42c097aacefb0505627d8fbb0992fa92eaad6411a68370437a1409b7f770bedce2b207fa53d9c80c09bb9345a3c2955857f0
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLmO7qS/mLHxbc:lu6JmVxd2dLZ/shc
TLSH
T142D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 08c0b5ff363a80f3a675def27638e32fa8adfd2739deca13245e73fdae87caa0
MD5 63017b2195cc957c6c75181d1caefacf
SHA1 f76a28e6918e3e7cff8695a32b8819fd4f011d7b
SHA512 bc13ad8289520ccfbfacfb27e5509560aeccf4e69dba76f0acd128f4b3256ad0aae469dfa8e59f1d8f7ffcc2e613cf1d857d7d95cd52dcbac9d73f59b1930e33
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xnmO7qS/mLHxbc:FmifPbRIZ/shc
TLSH
T144B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7dc5f15ce75729d28f36522b5446e6ad5007233cbec6a418d4bb522c240edf65
MD5 be9c42d2322e0605acd1f05ee1906700
SHA1 14deed08d3b5b0f159014c5979e3e5da29f1b0b2
SHA512 af818c2f92bfdd4255da2fcb4b10a15d424784ea455a3b121d35b204a4783f65f97bcbe5f645bf1dab0c9c756318688a76f93feee614aaeddf83b3ec85dbbd1e
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqSmO7qS/mLHxbc:95dKTi61SZ/shc
TLSH
T1E6C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42ef2c8d2b387d2c29bfee9dfeed0172f031eb198b75beb4d32c8ab96e053a0a
MD5 da51f0335e19ffc4916ade21ed0c1905
SHA1 890ad70695fc27174e839572c209a4f2199b875f
SHA512 aa66f7532edd31b2c2a3ba6fa86152e5fccd115f55c52ae2f6484536a45c81e01247bc9d51537a321caf284f85c4024db7a9ecf4c2a363865c78a3cc031e0354
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wbmO7qS/mLHxbcE:sX2iyphEZ/shc
TLSH
T1AE95BE13F2D900E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 36898223f5a4ab73dcccc332331ee4653849c6195ce890052e325643fe44eed7
MD5 eb69baa48d36a052d0eba5a5d647146b
SHA1 aed98ed8e4f6ac3e51a08fcb1ea510e304623d10
SHA512 8a1f0c5f79afd50d7ef7d01fde92b8e9f8ef4f5de739323706ddf2605024d880bde2b48600c9a2da84d9c6711d6ef0ef265cf3dd60452ce612a79bf17736a53f
SSDEEP 12288:HVMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:HmUjO7l86h/GaYBBPrZNxbc
TLSH
T1DC452306BC6548CAEF09CF71E290016B40E4A0FAAF17694FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 711c86a6b953937b4a669d3758ada5162ddc6d7069ed5eaf2eac9934410517cb
MD5 f87c984aa7dc60f0ac26877315033fc9
SHA1 25e6f3646986634cf0e64566b11f0c3994e5307e
SHA512 b0d2ddebea6fcb52efd306da976fc4bc9c003c73e756f5501b3b72a50c030468879274d7ff4ba67aa45bf119be82d69c7d60f54a6345ae2fa569272830c8e225
SSDEEP 12288:9CMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:9NUjO7l86h/GaYBBPrZNxbc
TLSH
T1A3452316BC5548CAEF09CE71E280016B40E0A0BABF176D4FB3ADAA60477E4E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8a1fede3d81a552ff852a4718974cac6cb041ae2042a8804d475771abf4b62dc
MD5 3ce4615046bf651113514cc4b69c67c3
SHA1 e75c0f0fe1af5c66167286449e0593dac5f5312e
SHA512 b2163e9036f5fa68d4ef11071ba98d69286284d600f12d78ef3eb87b6c6cf751121739d2a9a94e46d32a931bd1cd0e03df3e48ac1e273ef0167ce90e0f411684
SSDEEP 12288:rwMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:rvUjO7l86h/GaYBBPrZNxbc
TLSH
T155452316BC6548CAEF09CE71E280016B40E4A0EABE176D4FF3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 62b526e9f48fc15009d15d3fc2b2cfd4b60e8aab468bf88c3ac9c8ff9f07ec90
MD5 38adb0408b0c77de5f2498ee9e4423bc
SHA1 5f6ffd52821ea49af85a9abf7af3fc8a9f89034b
SHA512 9b08991c234a4a7688376a0142ddbbd2666ad8c414b5dc49547a2bb075ed27c5f8620087099b89840d45c240e370122886632eb761547d5c9884a1966735b30e
SSDEEP 12288:BVDMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:MUjO7l86h/GaYBBPrZNxbc
TLSH
T1394523067D6944C6ED16CB71D690016BC1F0B4F9AB33AA8FA3551EA40F7A6E0783DF48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c1f15ec760b3e4aaa29ff8465632d48e64cf3fbb47a15bf7dab8619646f74b05
MD5 7d1486d0b9d646427d4f508c69963f47
SHA1 c31887eca1106177e0901d109cbf52ad8d5b535b
SHA512 09da89a75b1c8be906a8958b898719ca2b693aaf2b922cb3ceb040d5a5a4dbd000b75084986a1747358afe06adfa3f92362270cc9aecdc32c3aabed58e46ed25
SSDEEP 12288:orMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:oAUjO7l86h/GaYBBPrZNxbc
TLSH
T1E8452316BC6548CAEF09CE71E280016B40E0A0FABE176D4FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 3a4cd66a3f0416a792528ce95012c28711b6a5426db0adbb067ebe053a249c3c
MD5 3d2f8045f4395cc14cabd18e9ebab2d4
SHA1 23de1d0b0e56e57a4802ed7e321380dd7305f03f
SHA512 3f1c22edc411c8d82802101fdad7e1807b12ad9b88b8b114b69b0e3a4c1e682852255917d52343f19edbd3f913ffcd4418975fe00b79866dae4a1efa385850cc
SSDEEP 12288:lGMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:lxUjO7l86h/GaYBBPrZNxbc
TLSH
T182452316BC5548CAEF09CE71E280016B40E0A0FABF17694FB3ADAA60477E4E5747DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f8407d9d0ba84da7111af9991d07f614931cdfa78690868f60e06c0e9d2ad3f7
MD5 1cde8c4c7b9fd1e20474e29f54fcbfd4
SHA1 eddeba5d4faa76d2491fa77a4745e6aca224dea2
SHA512 6d7417192729ff12f2660311fcd8cb02a6e7102983b24a27a6743be7e37086505f8cf2e08a6f7661758a2aebfbf8fbb9784760c3f04ae05f9f3e151a5edc24b9
SSDEEP 12288:4qMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:4FUjO7l86h/GaYBBPrZNxbc
TLSH
T1B5452316BC5548CAEF09CE71E280016B40E0A0FEAE576D4FB3ADAA60437E4E5743DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 8cabcbd8328bf6c06a3404627f1a64e130864ddfeb41a5ecfd9a7e218d26af85
MD5 2ab9099d7e7d853769bed396c0b2ec6d
SHA1 efda65b78781d1f682b476147f67f283190f6607
SHA512 7b04c6c17833778b561a758c8ce0e41d055df4a9ddf939fbeb7d9cfbc84eee4208b28ad6051f166393260d5ded2960a849407b5b9bff89f5b820a51069cce72d
SSDEEP 12288:eiZwb6zzFEoS2cPvyiMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:BZMSzFVSOtUjO7l86h/GaYBBPrZNxbc
TLSH
T11A65F195B6900CF8ED67863EC9554916D2B1BC6A0B60CA0F13F836664F373A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 066e3f58fe2222e01f32fb4cd800bbe8a868e913023f7e8d117fada9b38e4582
MD5 8cf2b4118387762f683271b9f04fd26e
SHA1 2b1f8b35289887fb81437d01eb9d439855f5c8a8
SHA512 f7e8978da519cfc24d9c3e2a6596521104f2759a75fd0b17f5e143b2048c884719750ecd8d9896825f95de97679b7401dcd9e2232ef0d8089354a49c8f330f0f
SSDEEP 12288:NhMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:NiUjO7l86h/GaYBBPrZNxbc
TLSH
T1C2452316BC6548CAEF09CE71E280016B40E4A0EABE176D4FF3AD6A60477E4E5743DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 26b38b795c4c68458a2c3d473bb0132b8174f5597ea896ff1eeaa4e780d77147
MD5 dd1da9b57b91161c3b6b5ea93a9fa749
SHA1 2c4754ae9b27c7c67ac23c92df6c83af9601fd93
SHA512 4372751694bd4f2e36b9c94e0955f7c19534a61e584eef6b12130974978e412640543d73554f4338c716e4b9bc1f22a1bc1cf229c58d0c68075321813b2376ff
SSDEEP 12288:iNMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:iOUjO7l86h/GaYBBPrZNxbc
TLSH
T141452316BC5548CAEF09CE71E280016F40E4A0FABE17694FB3ADAA60437E4E5747DD5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2746d4e3bad586898361dfaa3480081948a1a2222b3cdb1357a392735cebb74c
MD5 b8e8f3cdffd5bd443acd130d693fad2c
SHA1 d681ce063ee0548a95560cfcdeb165a7fca48a6e
SHA512 2e6c78673347d682164a2e8129b50414f3037424fbd680fd59e71b6dff4c096d3d248dac38b83b2d5d00f6d33e467e0125734f04cc8ac89a68cdc786dec1dff2
SSDEEP 12288:wyPz5L8+MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:Bzy5UjO7l86h/GaYBBPrZNxbc
TLSH
T1F155120776A120FDD5278235C9A10A17F3B0B4764B219E9F63A447761F3B6E1AC3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 7cf3a9c92d52987e00c6f5e047868353e83ec6a39f15be3b408622cfe743cba3
MD5 93d605a6ec8a166aef00454f47d446a1
SHA1 16607caedbedde7abe3ef1d018d15600282938f1
SHA512 c9e27195d8ae16c2f8297a8203768770ab52927f8164dab61d68746752ce150d9fa7ba9f5713216737006053964670d814e04a917540fa5dde22a8beffcaaadc
SSDEEP 12288:9hMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:9iUjO7l86h/GaYBBPrZNxbc
TLSH
T1C9452316BC6548CAEF09CE71E280016B40E4A0EABE17694FF3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ace203ae187edc7fdb10be6b274423b98abebaeb8a6a2fd8dd7df8c7b08d5676
MD5 61da40834061edd65751fd8993256fa1
SHA1 a319e0523ad10da1e3c035c3d9944ad0f51050d7
SHA512 c23f850522aade380c20f6cdefa4c1ee30a2345c71219014499c24c7c2c0e6f6cd7ad3ac721e89f0fa7ecfdfa991276431171181a3675ed597095f7b16cfe49f
SSDEEP 12288:ThMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:TiUjO7l86h/GaYBBPrZNxbc
TLSH
T136452316BC6548CAEF09CE71E280016B40E4A0FABE17694FF3AD6A60477E4E5743DD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 af4ddc5f746f96a14b5fd7bd847e2c1948bf53feb8469f9e3611c3eb64b1dfba
MD5 18af7a1c64a00934fa9034c6f443c5e8
SHA1 f1fd71763592de559d73b275f5415e903a93b6de
SHA512 e40b00ac6d1d75e9bd6022fa62f6764e0cf4404472cc07248d5b2de1e1616eb43e84e1f8be2728a12ad4fbfd324ef14306eae33ecbc3e1b644ad0e53bdfc272f
SSDEEP 12288:FyPz5L8+MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:Mzy5UjO7l86h/GaYBBPrZNxbc
TLSH
T10955120776A120FDD5278235C9A10A17F3B0B4764B219E9F63A447761F3B6E1AC3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d8835fe20fcd89a0faa77b167dd83c0b22493db330c395d1efc70082d0b988e3
MD5 0844c05926cb1e69bc19bd798c7c71db
SHA1 9ae227c14ef6c86a8485ab647f07ed8abb540300
SHA512 4ddf4ae35c587a06b22637f811f8f061e1c040a687aeba8a894fc56d6d68bbdf81023f36e78f57b6d3ac777b2fa194d5e84144b0c1358ac5781b919afbfcbdbb
SSDEEP 24576:JTHaLl3z0zDfUjO7l86h/GaYBBPrZNxbc:JT6Llj8mO7qS/mLHxbc
TLSH
T12B65F195B7900CF8ED67863EC9554916D2B1BC6A0B60CA0F13B836664F373A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 7a54578851ca949cef3acd7200b2dbf6d339a9790bba66b48e54c15638047043
MD5 23287aae87aa9f512f681e07daf22a8d
SHA1 c38827be6f1986801e9b906e30c1297eec7d9995
SHA512 504631bd28bbeb6ffbf0b59224d224e69a99a4b37d4f909ecf65f9900d2059749d1ba5b08b25b7a0ffd028cd294c475842971eee9de2967f055d6e3c7e3341ce
SSDEEP 24576:537d9CHKy7GZjUjO7l86h/GaYBBPrZNxbc:J7d9CHKyaBmO7qS/mLHxbc
TLSH
T1B775CF90F7E414E8F1B78A35C9754512CAB67C9A1B31DE8F03A8265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ea1b3dbece917f6383116a79fad5d64c675b3d527ec1de40a3babb2a88ca10b5
MD5 269d98cd7e3c3f4b29ea1dfb4999b7fe
SHA1 defd7d37851e79009bdfd647808422d817ff691c
SHA512 b1916b10fac850f5e07ee4aa2a56c71c07c68a8e3879a258976ca3b8aaab965a59e495cf5fa81bb409533e852204f1075ab8b5e8c4d59e62bd3f220d416dc60d
SSDEEP 12288:9QMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:9PUjO7l86h/GaYBBPrZNxbc
TLSH
T1D6452316BC6548CAEF09CE71E280016B40E4A0FABE176D4FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 25ec644dd7347803880814948361723737e617888677d613c529cb0e72d4021e
MD5 e7ab6aa3256095ea3686c4e07d54e04d
SHA1 bf7546be99d41f9ae0c76ec57eaa47aa6e95e550
SHA512 800a25c23d214de7922d05fd335a2951553b0ff92458ef1518f32ccceef30a7ca7b4af5f537734caa0b84ff935e1f1979c7111aaf559e3d1f3260d37a1cd95c9
SSDEEP 12288:OeMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:OZUjO7l86h/GaYBBPrZNxbc
TLSH
T134452316BC6548CAFF09CEB1E290016B40E0A0BAAE176D4FB3AD6A60477E4E5743DD5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7437693523a3b524ac1ba19c1a9a5637601bfe70877a7b39e0e60afd1a8182c3
MD5 426955bd38a948e57e7175a24be05406
SHA1 20e62bdd9e27a82272900ec8a5a593cd24a11f1b
SHA512 2a44114854d41a4fa35c246f87c0f62d3dbc9248ec4620a0cee953d196bd95a8a94f328c9cf8bdafcbd067620932ed9a643cad04c6e73720f3e3b004689bc9a2
SSDEEP 12288:BfMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:BUUjO7l86h/GaYBBPrZNxbc
TLSH
T181452316BC6548CAEF09CE71D280016B40E0A0EABE576D4FF3AE6A60477E4E5747DC8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 48e6edfd14e361cc0d6dd2fb2b04f4bf4dfeccbd696b18d146ecdd32af58514e
MD5 5de9eb0e2217f678edf9555072c25cf0
SHA1 7e580505c29e721c42dea74d423c1dd4c522335c
SHA512 4415a05e59837766a8b715c297ea5c4d593ad378b37f8ddda0b9a02d33ffd3bd2a3927960a53764cd6a598c68f8a46174c2e18a31e639cd7154312b481cdde9e
SSDEEP 12288:XhMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:XiUjO7l86h/GaYBBPrZNxbc
TLSH
T125452316BC6548CAEF09CE71E280016B40E4A0EABE176D4FF3AD6A60477E4E5743DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 aaa4baf9c25ffc9014e617ce8871e618207448a8e1b4c4d053c896f2acabf215
MD5 48b230604cebda25ba281d2c3c4a8d8c
SHA1 ef3e68a58114efa700c8ade7fba0854c6a798f49
SHA512 cc6920c9d0d6b4c98e8479d59e0259c4a234c6a30b3e3dbcd34a6c24988cbb864877d44e5540443bd643c2b4df48fa5cfb9fbf6973ee4dfeb905489a17eeab9c
SSDEEP 12288:7QMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:7PUjO7l86h/GaYBBPrZNxbc
TLSH
T174452316BC6548CAEF09CE71E280016B40E4A0FABE176D4FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2ed3d2087bb22e47288a1044e9ef8be21ec449b143c18e8964c1624b925762c6
MD5 7e1a1e0e051b54d486b987de2500bb72
SHA1 e4fc515d696e08dafe60da06c28d632387b33b07
SHA512 5b293e66d8cad04eb4a4e3aa3dcc9661be9f1ad102d03623f7fdbdfaca2666ed3e0095f984aa89d4d7386c61da3c60a6a8786c377ac4d298e007689b61ab28b0
SSDEEP 12288:uJMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:u6UjO7l86h/GaYBBPrZNxbc
TLSH
T1F6452316BC5548CAEF09CE71E280016B40E4A0FABE57694FF3AE6A60477E4E5743DC5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 eb8d9fe1de22d140ceff1d93f1d763c92be2dd9ee4a71f3aaa14eb4067567031
MD5 48a377fd0db9f9a1fda759b6baad9054
SHA1 edc4caf33640edf0725aa881a1e5e69c45882099
SHA512 7d4486ad2256d8541fbb28a71e4666420741940abcf4b6a12e6d476047fed02b6b6d661db42201ed7568cc2885c959fd4d916d5ddba9ef0ed7f9da61a70f2d35
SSDEEP 12288:prMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:pAUjO7l86h/GaYBBPrZNxbc
TLSH
T183452316BC6548CAEF09CE71E28001AB40E460FABE176D4FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 9fab5b212b4ccc2a5ec8acc33d2766a8c9dc76bff478c1f3e4b211012151cb50
MD5 a8dfdf826c9f0e02b243ada06ccf4714
SHA1 e0b885639ce10311b1d7bff35755b7a2a0c8146b
SHA512 502931928b334ea1118875e9fe067b3eb2bf5ada2873f2241ad9da4132d927b9c37671d36a5c242396c37e70b62819f348f8c816e224863d99c862f47a4b07ae
SSDEEP 12288:QIMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:QXUjO7l86h/GaYBBPrZNxbc
TLSH
T1FD452316BC6548CAEF09CE71E280016B40E4A0FABE57694FF3AE6A60477E4E5743DC5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 2b6f262828663566daa36e93268857c3b2b9d43f0ea9cf4c7b9f59598a51f700
MD5 0de0266a789a9b6b9c044880ad83296c
SHA1 36bcdfef4e45a766cff8dc202bb27be56aa5bc8c
SHA512 36b6798ac796ff4e1c72a371cad4b0be2e239460a5bde94e83c94d6bcbed850b04a8db2789ccf425ce945221a9932be968d44217aa7ed1c5a2780e54f291d212
SSDEEP 12288:drMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:dAUjO7l86h/GaYBBPrZNxbc
TLSH
T156452316BC6548CAEF09CE71E28001AB40E460FABE176D4FB3AD6A60477E4E5747DD8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d48ab61e42e4776e7c05adb8ec9505e908f346df8b0543fc34e07fc086211775
MD5 cb4368d096ecd3a5f929a31714917a3d
SHA1 db5aa19428e99b22957ccdfd46aab0c072398232
SHA512 eeee3547934d671e9a2dad1cdf55c5c61442bf7e496c26d08f55bc7c2b0695fae1bb56e315a12f3515959122cefefd4fcc0e2756713e1db299ee235dc7f7a835
SSDEEP 24576:yfwvok9RX6wkyAIeUjO7l86h/GaYBBPrZNxbc:eMnYIemO7qS/mLHxbc
TLSH
T16585DF29EBDC04E5E177923C99B3460AF2B178691B31C6CF129A53AD0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7c8296d65c18b70b77b7b1cfd0cb2f18f2be969d2efe97642a90843530a18383
MD5 8f854a87eb72d5491b09f5c4a9291156
SHA1 df51b774321f10a5b4af380d2fd17b78d747c150
SHA512 86e144bf751bc58e41b1102f772a6cd34519176f24909c6283135cee1f3e327192b5c9c1473a46eb7c373ed22983d8e2ba055b5b53a53c448abe3f242397ddd2
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07mO7qS/mLHxbc:9ySzPjZ/shc
TLSH
T1B0067C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 27f4ce56eb118178fefd63ec6dd4a098d8f95df12ae6aa0658e6fcb865913631
MD5 d815113eeb8529126e6bf5ce44ffc09e
SHA1 0266b6949325c4816f68d89cc040083afea910a3
SHA512 d11e9573f2dc561ce420520e2e3e2dd354b1d5455e5f0c10b158dd4043bcabc3c806deb56a73ae6069875e08b1bb1cc3dd76abd7606be6c303a4311f27235ea2
SSDEEP 24576:p47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9UjO7l86h/GaYBBPrZNxbc:p47JUQj1irIhCnDHUPfF/LmO7qS/mLHy
TLSH
T10565AE1EA3EC01E5E1BAC27885154A5AEA71742E1F31CACF2270837D6F27ED45E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 98d25b4dd97c304a8b1f57dfe03b83abeedeff5b6c7f0d83bc749a3f9fbd901f
MD5 592aa8a9fdc4d732ac3197cb60648f6c
SHA1 28b23abfa5d6c9c3bd0176c4b6a56f398b85f286
SHA512 4282a3c9a8cc45b11a090c18a3d5906b7806e4133db88a86a103dba1bde7013566fd26d1ab9d223bc9a1bde7e7ff9484a67be9896a0f568af700a46a7b3ef92a
SSDEEP 12288:hNsfxMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:mSUjO7l86h/GaYBBPrZNxbc
TLSH
T11D55F00AE69802D8C56E9275C7510642B3737C6597E2D3CB63D0F97D0F7A6D0ACEAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 cfa0a887ea63d4c02b5cfd16703f74e6f697cd499305ed16685b0712b3b54d41
MD5 9c7adba6ebfca020fc50c89eb4072b6b
SHA1 ee83283d1f298cc8d5e6407580bce7fa559f8630
SHA512 5f015e47be4adcb766b5c847e038b3a13f0f7031c52764e25d48249fe2a13fb13729ddad089148167e56eb64bf136b80438f59451eb5de89eb8023d7a869126c
SSDEEP 12288:bO4eU3f0IQNJWOBGGM6lQWTPPsOEHXSRoDiETgJTrx:bOrUPlQNZwwl41HiRoDiETglx
TLSH
T1EB453A50B626C74FCA6D80325E72D6CCAB703D41EE446F0373C9973F8576658BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c94d3bac30fbc9ee0bc59a9bdbc82d5c20eaf635ee7e490d067a5e0ec44525a3
MD5 31ad87e244d8d7fd5c439acf2aaacbc7
SHA1 ec6bea0e4f7b0ab086e303ad3afb1c3b291dbad8
SHA512 2b12e67bb97151e1c3aba26056c76a7399a5b6ce66d7ae9bbe33d43e1b705013a12f1e1ca3a8541f661156f7301062e003ab367f4fad3a0df801a0ef0264f50a
SSDEEP 6144:ZQkPbX+2G2aWRc+Qt5n7G8FbtWKIXPwlsQmtMx+6QmtMx5VQiAUmimxb1UIsUfJW:TG2aWRc+Q37G8Fbtgfwtz7sAWDAT8
TLSH
T185751A41E137D38FC1FA5072033A5B8C6768AC177B496F26B388457AD86AB15B0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9a052f5d55de404140b0f5ccd91766c538d2e69f89e106a5f36225fb6bd98161
MD5 34ab166d8145ba6bf9c65aabbf765b46
SHA1 ecccd744c147cf34e7843eef046d2e99c9e0446b
SHA512 99909471d4dc63eb70f2a9a4ff3e646fd9ada744fb99ee94c5b7c0b04def4a5ff3eb661eaffd1d83138652cc05aa0041cf1cb1e39bda9b830ed361651e69298c
SSDEEP 12288:WM7ZMUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:TqUjO7l86h/GaYBBPrZNxbc
TLSH
T1E7452312BD694CCAFE2A8E70A194013B4064B0B95F01A8CFF25D6BA4477E9D1BC7DE4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9dc3716838aa7b7b0c3182bcf4909c0d8cd48692774c821563f38ca4c0487db8
MD5 dba2b1a8f331feb611e8d8923ca5fdd9
SHA1 3c5b03867945b3aa88438295717dbe5a94935824
SHA512 6b45fdb6030819510b2ca633d1ebc4b2b770362c0191335b578ec2bf3c60ab93e927f63f0913bd4e538ac1362d69d99a4231450700958f5ac8c3aa6e11bc2da9
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bY8UjO7l86h/GaYBBPrZNxbc:Wgb4mBIBhGF9mO7qS/mLHxbc
TLSH
T129659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2CF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d89c5df0cfea471e044c2306439ac22202a5a869582792c4e72477e0781905e4
MD5 4964f414d893700aeec3e6c9338cb158
SHA1 b4dafc14d774e28f67f1367e8a07686f6d132954
SHA512 5ea550e69628197a4d1bc713bfe9c3c345a71b771ca316e23208917a7587eef09719b658ae5f8a585cc5085bba2405625545cc10b3470cad8b0d4f515287cc58
SSDEEP 24576:gG88u8FpJqH1bzria7/mtUjO7l86h/GaYBBPrZNxbc:z7ZFPqVea7/0mO7qS/mLHxbc
TLSH
T15E85F165BAE101F1D47BD1388A824667F2B1B4251364EFDF07AC8B510F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 8749772cfd3b431d9d34eb49c4cf7bab05b2ce41668d5ba7ce7a84ae67556523
MD5 d0d6bfee18bbe598cdd86d7d30974f8d
SHA1 1db7d98e8f8fa8528df3de3d5607be0ea3bbc475
SHA512 81623ee2b08d81c113a7c93280b3c3f6f0337d90e10329e9a2ad976060c7e475b8636b7d54372462c836e159902fc32cda2d115152ff4bfa1a43d5e1c4742eec
SSDEEP 12288:QHvUrBFrEjwaQ2MUjI/Qwl8RgoaC4XeFJaYkR0BWU3zHvRN3JdRTVYbqmuc:QPUr+NQBUjO7l86h/GaYBBPrZNxbc
TLSH
T1BE65E12F65AC1CE5E67AE17D8582461AE371B4621712D6CF02E0817E4F67EE8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e15cc9c7aa4fcc40d5b71e6783afbb6aa0585b062042900f4a8f3c37c69f0591
MD5 061cbc228e74c424367814dd4dd07a3e
SHA1 4a8107668d72a94767a5193d41ee48fabc5d05b7
SHA512 5bb47c5eb7d98f249b88d3b073272468608e3f1692cb1ec7453635728cea7a0d9c869441ad14caeb5a2ebb22d9c76790632dac0db516daf9fd2becf41fe10fd6
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxmO7qS/mLHxbc:hG05lO43b2Z/shc
TLSH
T17DD5CF6A62EC11F9D1BBC17CDAC6460BEBB23425033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fdbf870be748534fc825de5157fe7264ea75cfe861f4a169078da1780bbcc6f3
MD5 173b7182b056a308c9b16f1b9c0687c8
SHA1 e3275df24b56ddd3fb5cc387fe00076b440eb346
SHA512 918af470b0512e7293254362c4490e4ad52b1f79553aab4e512c7246f5e4eed433c4b783759eb819077460832932b4b17d3171e17724ca4b7f39475eaaf9afa1
SSDEEP 24576:yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn7UjO7l86h/GaYBBPrZNxbc:aa5POZ3+Jt2pasx2+mZmO7qS/mLHxbc
TLSH
T12D65BE5EA6FC00D5E5B9D17DC583461AE5B1342253329BCF122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 da21d7e3c70e0274d04939184f21d2ce28e99d37892c76137bef3a6f4293d48e
MD5 90b89901b76d958969f843a5459973cd
SHA1 e39d88937df4a2a6443b412d7b42488fd223bd1f
SHA512 9458ecd981358aa4012701dc9f16d7ba955a0103f3dde33305c83763ad9fddfffb252fc53410a4acc6a98820772becde220a674c3c1c0a7558c0bf765f5656a6
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fk1UjO7l86h/GaYBBPrZNxbc:SNc/zEOVHFUmO7qS/mLHxbc
TLSH
T113858C1622E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1F73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 68549552572b74efa13625e99d6b0fd05f4eda2c0528fbb44a4c28dc6cb83ec2
MD5 9f761c7df269d57a4a17522b1192f2b6
SHA1 9f2466f82840d0fc94008dc5cf20b4cd0186dd6a
SHA512 17d9e82c92dd1ee09595c83c1916b7a5f108354a43a9997c273047a157975c1e3f5e97bd870475645d10c206da7a2e385da4ec9ee0041fc9f754d9b986abc5ec
SSDEEP 24576:g8kNvNnaFeYhJNtmZBmXUjO7l86h/GaYBBPrZNxbc:g8MwBtOmXmO7qS/mLHxbc
TLSH
T19C55AF2EBAB846E4D1FEC6B5CD238512E6727461073293CF5290C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e2b4ffe118fb664de3159f4c044f19dfd8ce011f1ba1ea7791441421dc53f298
MD5 94bb11bdb270d3bbe09cffac9ef689b3
SHA1 9439b0f00951f89f7e45fa143b14b30f20047e0b
SHA512 adc14e8c38b9efd3f5686ac025096e572c209a3a0d4417f548c0a1072027eaeaf5b7ab34f03c73976f973d1c1e3905bbfda33762130b1b4f3a943873f71e0aad
SSDEEP 24576:kD3FHshBIYQgAGUjO7l86h/GaYBBPrZNxbc:kDVHeBIAAGmO7qS/mLHxbc
TLSH
T17975E13EEA9C04E4E57AC1BCD6634607E2B134A907226ACB12D481B55F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-189-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/108-444-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/108-182-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/108-183-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1880-460-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1880-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1880-458-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1880-155-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1880-162-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1880-164-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2212-454-0x000002BA6C4C0000-0x000002BA6C74B000-memory.dmp

Download

memory/2424-134-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2424-361-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2424-140-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/2424-131-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2528-132-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2528-105-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2528-126-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2528-112-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2528-113-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2528-106-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/2996-453-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-217-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2996-211-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2996-210-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3276-80-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3276-71-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3276-88-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3276-161-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3276-48-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3584-646-0x000001CD25620000-0x000001CD2571F000-memory.dmp

Download

memory/3692-7-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/3692-144-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/3692-6-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/3692-1-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/3692-389-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/3692-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Download

memory/4356-145-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4356-383-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4356-151-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4356-146-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4552-127-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4552-119-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4552-117-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4552-346-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4560-440-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-168-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-441-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4560-443-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4560-169-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4560-175-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4764-101-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4764-100-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4764-181-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4764-99-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4764-93-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4848-473-0x0000022382A20000-0x0000022382A40000-memory.dmp

Download

memory/4848-469-0x00000223801E0000-0x00000223802E0000-memory.dmp

Download

memory/4848-484-0x0000022384180000-0x00000223841A0000-memory.dmp

Download

memory/4848-475-0x0000022382E00000-0x0000022382E20000-memory.dmp

Download

memory/4848-474-0x0000022382E40000-0x0000022382F40000-memory.dmp

Download

memory/5004-206-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5004-195-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5004-203-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5004-201-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5004-194-0x0000000140000000-0x0000000140168000-memory.dmp

Download