a1c1871a8a7a394022f6f4c6816d0a559b192d540c82234f2a28f68fb4e644dd

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 6.2MB
Sample260707-lvgewae13x
SHA256 a1c1871a8a7a394022f6f4c6816d0a559b192d540c82234f2a28f68fb4e644dd
MD5 ddc188bdd50ba9d1e67f74172629cfe6
SHA1 0db69f664596e994e9ecb602a5031a398219ea2d
SHA512 662ba4f1915866c0f1ca4178cd07fbeca51743843ebc27a3a231f517b24247c23f2963e7054d65b5acc45aa57643e01303dadc998c84fe1bcde2d769779872d9
SSDEEP 98304:Qk7p8O/WQdi9XtxU+lAEeT007kxtD527BWG:z8O/Wci9XtxUWAE9076tVQBWG
TLSH
T10F66BF17A3F900F8D8B6D17C8D928517E7B2B8154731DBDF0690966A0F67AE05E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
1556	elevation_service.exe
1444	elevation_service.exe
2396	maintenanceservice.exe
6100	OSE.EXE
5100	perfhost.exe
1448	ReFsDedupSvc.exe
2968	SensorDataService.exe
3344	ssh-agent.exe
2964	AgentService.exe
5868	SearchIndexer.exe
4900	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5c66482584defa61.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ae6fc6ef60ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000380c556ff60ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009ec04d30f60ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9a0942ef60ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc37a72ef60ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e504630f60ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005e62b6ff60ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a0a87f30f60ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{8C1D46D2-1F2E-4919-88CC-43D3D784B7B3}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{ADEFE6D9-C366-4132-A0AC-85BB62DADDC6}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
5160	explorer.exe
5160	explorer.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe
1444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1284	2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	1556	elevation_service.exe
Token: SeBackupPrivilege	1448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1448	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2964	AgentService.exe
Token: 33	5868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5868	SearchIndexer.exe
Token: SeDebugPrivilege	1556	elevation_service.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeShutdownPrivilege	5160	explorer.exe
Token: SeCreatePagefilePrivilege	5160	explorer.exe
Token: SeDebugPrivilege	1444	elevation_service.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4924	sihost.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe
5160	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2436	StartMenuExperienceHost.exe
5688	SearchHost.exe
5160	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 2880	5868	SearchIndexer.exe	98
PID 5868 wrote to memory of 1124	5868	SearchIndexer.exe	99
PID 5868 wrote to memory of 1428	5868	SearchIndexer.exe	100
PID 5868 wrote to memory of 4524	5868	SearchIndexer.exe	103
PID 4924 wrote to memory of 5160	4924	sihost.exe	108
PID 5868 wrote to memory of 4160	5868	SearchIndexer.exe	116
PID 5868 wrote to memory of 5140	5868	SearchIndexer.exe	117
PID 5868 wrote to memory of 4332	5868	SearchIndexer.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_ddc188bdd50ba9d1e67f74172629cfe6_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6100

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5100

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2852 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2824 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5160

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5688

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b6d759a762e9660a5daeb2e00d4202dde509d3f90342e158ebd842f9c3c40c5a
MD5 dee20bec4dd8743036ed16345cbdee2b
SHA1 54a7d0dba09b04733077aac188b8d835b3f58d59
SHA512 43978bac8dca4806f0f8fad5841980ee55a92655166260f3637f77cde835dd6b8cafbbde065155ff21ffde27757bd427e3607639bd518ab1048a669f2cabc0ae
SSDEEP 49152:Fb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnDDmg27RnWGj:b3q6sjBID527BWG
TLSH
T15CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 fe6e8b2ca39da5584863a19364d735fe4a8c55f19ffa86b8ec2caa0d48775f03
MD5 fc709cecd0091997eefab4a417dfa30c
SHA1 c46fe6b086205357f82c878e97a4e7e7935be759
SHA512 efaa0ffeaaca87f2c83667062ca57b93fc520ae3a4b32015d4ddb68f4c291a697f15dc8791fe1dcbb3a74b2962a19aaf0fda712b4b220bff0f95941f17f78146
SSDEEP 24576:GXYfDtczAAsqjnhMgeiCl7G0nehbGZpbD:ltcpDmg27RnWGj
TLSH
T153650129B3E408F9EC67817CC9A2C515EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 7f97757f564024e01c8bf69fb87a98280ddd0d7fb01e711170af623f0f7ef3f7
MD5 77c1a07e2897c1c7e508b8f87374abbd
SHA1 37461227402765fcfb031171f2f07edd96a79d04
SHA512 cb92a029bbaaa136f58b01995218e3391fd5e5e89bf4b80ccf95256a1e8ac1fe3bd2c7005abbf5703aad0a6105da395d5e31e19ae04fcf0841485f9b9c8c225e
SSDEEP 24576:W0Le5ji0hmxxrMdsqjnhMgeiCl7G0nehbGZpbD:WPji0AjwDmg27RnWGj
TLSH
T186859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f35296f581600f52b8e6987f7553b2683d63a8af90e41e505e7b7dee389af13a
MD5 83bedcda43264211f17992e2c6af23bd
SHA1 26002dc625b13bd82d5541e06418bae1a48c75aa
SHA512 4ef7129ccdccf2e1d513c61f13f75c50d2aa6f4a77135b750f1e01c6e4c82a8e7019165472cd381a586c525c3ff66967ec54a3e86b01d903f655ceae6f20fdfb
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWn6q8wyu3sqjnhMgeiCl7G0nehbGZpbD:K/ezSC6vUzPveHjy0Dmg27RnWGj
TLSH
T152755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 94c517d7c8a022666811f3525642a50e659e428167fc3c24bbd47185dab4b68d
MD5 f861f29696b4b8b984e9b41405545033
SHA1 6bfca4ec0273f67846246d890d4a5e7fb28c0ca1
SHA512 71193018edb4cecbac6501889f2c5d211bdfa30458e22c971cf946e0aa0bcee6aad08a56b3fd14b0b20e307bb04e5e2366d99e63f52b6b3b4271f7a50257260b
SSDEEP 24576:1VbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:1VO88hXl+TDmg27RnWGj
TLSH
T1B6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a63c50390b983222f254b5e2f9a2b8fda35b8e761d08512ea7169fcf5f0f7ec6
MD5 9a85e8b7b7f60f507c439bd3cbb5c917
SHA1 93725554904abc1c6afc887c14991d00db1ea015
SHA512 359845184014347db8eec3bb479f297d20cf2d9bf98fd64c31550b8cd4144d797723e066733a9ac839d115dbbdc206cd526815b8847cccf84d3fa272b62b0603
SSDEEP 12288:XL5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XL5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 0c16f2f686962872bd6cc0e51410a5a3a3b0b29179239f40810259ed85f2af8a
MD5 f24405c595ccfe441ffda9fde73be8be
SHA1 1055a632a6e3351742fe9d6948ba82e54781b8bf
SHA512 8bab3a80a87129bd9372515827dccdcf15a3f07cc940fb08759baa469f7a045ca83e82a209cfd25cd0ffa5bbd33d4d9f4ec63a79571086b736b1134ec25952ee
SSDEEP 12288:DeBNUbTVO86USXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:DJIUSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14B65CF7BEE28FCD2C27A8DB85791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 77182251cae135c4e838616a7300bc4daf825a192bb38b7bc8531858a22c3202
MD5 8c43105c864e044da612caf1d0d72f57
SHA1 5894630b71aa6ad903a26f6a27164fed28ab3cf6
SHA512 ff4956b4ad3b52fa01c09300adcdf70fe31148cea714014336c678f72b8d82e335a5d0209e5ebd86d84b453f8c2eb9a2c706723497cae169d677f7540b8f3c63
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:lQvGAdlCEL8c/DRNw5C7D527BWG
TLSH
T147266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 0d30753fa787fab166ac3e5005f998992bd4b6c939b4d0282e020756bc71e8f8
MD5 5f16498b5180a6cb9e3c4386af897bc9
SHA1 7336c782a8df776b2e0933bedd808a6707336f2a
SHA512 126cd702f2ff1826406db61dca7542cdb4003dd8432ea77b18863892bce4c14b011d5b8e0bc99f82bc23e6b131df55c354a3903c2636e5d358cc1a50a2b3eeb5
SSDEEP 12288:bAwSfxL/2Dc3RDLLmt0LDQewsAjEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:E0ewsAjEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9cf2b31b4825eaab3cef6e271cfd211c0e8d61258beaa3f6dffb331e58704ca7
MD5 7803f7a73d3872bd4ee436a3c44829b4
SHA1 35827d4f70d2e583162a7c56b620d5117bae692b
SHA512 21426c8e00ca4a6be140f9dbfc5b4c58ae55c1e99dcd4456419f738ba972e90a045b329731cf07053cb1f4ad399e532bc702482d805f333d8321a542e2e0f443
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIVQBWG:kUEtQevvqc2W1cpV2tI32PB
TLSH
T1C6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 61568ba4007312a176be37fda3f226204da2f8afd6e1612512024a323a8badbd
MD5 5ed86590008d4d17a60b62db58de542f
SHA1 0f9280272296b78c4cf1c8bf17baa8ce324407d6
SHA512 084fc5ef06c533859d1c6a71cd9cc870ce9b152eae9a716aede675a77a889ebc412115913cdf3f2e36ebc0bc4814e42563345fb58b55ed786db871944021f617
SSDEEP 49152:lCbRquA/m2yL5zTfFiV+XenmE3/zADmg27RnWGj:yoquVjnm/D527BWG
TLSH
T17DD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cdedeef02a25387239a7d3867307258149ad7904689c602480600f1143a187c4
MD5 baf7eb6fb93e938e6ab0e858d9489c52
SHA1 6e35064f26bf7a18e5674b23c8705bbe7631cdd4
SHA512 3d4e782e990b8e801d16666393c010d3a05dc54f25802b1b1abf328ccc9e73bfbb3ca7beedf1d5068507589feb6ff5d3ac2c1b4c65360611061c7668e6309190
SSDEEP 24576:zAhGL3IFoiwtA5l7S53rsqjnhMgeiCl7G0nehbGZpbD:zAMUFoiq5vDmg27RnWGj
TLSH
T10E359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 8107a8caf0222d5da924d37d8d274bfec6ab0af163838e8e270ff0739dcf4c9d
MD5 22b7fe5adeb324fb17def11763201578
SHA1 8e4c200ad402dc9b5066e0fb0b0c919c6e639f17
SHA512 3a3a674e89f577a57ea71b257ddd40aa85be02a54a28dc6279692ccf3a7fb08bd26145a821d7f73dcd2eeb62faadc7bcf0552657436d4d18b7d60ad2f7aefce4
SSDEEP 12288:6mw5HEjsChNVBFgl0WDm+ClXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Twu4OWmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18265F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 526ab48a285517b80c85858430133c21c6df1aa92310539618493009633baf28
MD5 9cb55fdcff365dccf7019c12498b7534
SHA1 c1a4ad4ac0108899a5dedb4d78d2d38f321bb577
SHA512 3dabd39216c61271f01404ae8dd7ccbc55dea352e79007073752890f917a56c624569b75b3820a5691fc66af65668ea9dee38456a2a29632d5945941e0d15964
SSDEEP 12288:YeZ1Iy0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JZulsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1325512AA239820FAE163417CC5E5D609E7337C62673003CF16625AAA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1ea7c8dea6fd677dc43d7e2ee9dde46b89fb1b5f2d767485a842f58c62de67a0
MD5 a58fb39e8094ed1675feb9bd7986521c
SHA1 57d579d02872bbaa7fdc32cffab2b48d637df95a
SHA512 35cf846546335056444d9d09f07b1e85091f20ad5bea0a02dd886fee2b3a73ce1dfb5178c9e8006e681357a35a32a2077c487322262ed4c6b164f4d658d02855
SSDEEP 98304:UQRQyi36YOcPbLvw2gAf+PN3KD527BWG:7QyiKa/X+PNaVQBWG
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 21e374975670c42de948accaa028e55e4e53e8279b5c73581de1d838cb38e131
MD5 42203b5fbd9c06ca52c96852ff8a5dc1
SHA1 4a48b7bbf732fad7e64e7a2f617ea812974e6add
SHA512 5e4309b50689a15205b513f60e48ba7552c8ea2cbeb09112e2e2fd430fd30f507f4f417d3bc7d56b10ef5b4fe6915870830ccb5316a06793db95fcf2112dc395
SSDEEP 98304:1QRQyi36YOcPbLvw2gAf+PN3KD527BWG:MQyiKa/X+PNaVQBWG
TLSH
T13E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 24f0f81efd4cb48763f42ebb313d71b1b27330da1c3607e4b58e45d7464139b0
MD5 e4f408091c73c948f4832c5bdd35135b
SHA1 07c5b839feb3e7ae9f1b0d72bf6f3bf21c6b1ff1
SHA512 bb4eb566b48fcbe7c909dd7519ecee42e32d454b64673552471cebc37025c4fc5e99fb17a504bd199b1035a3361f3c81d65a3f9c3ce7f568225da5b910aaa41e
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL01sqjnhMgeiCl7Ge:j68Qg55nhceWu7PNU3/wDmg27RnWGj
TLSH
T1C6B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8254ea4f4df4a2e163081f1165fa44957c936db6fcdaf387dd39ed6b9c710899
MD5 95cb383b6d07e148a8b660273e7608f0
SHA1 0ef26be4f5ff47c573447bc0b5b6624f192bcf35
SHA512 0101478a5315299bc9b16562eeade6fb06160c8a6c4e05a963ae85432c9f11812f517e2916f5da90579b853640109133f034cdc819bcbf7c9b64204456cf7f7b
SSDEEP 98304:Yy5112gYy5azzVvt69nLKnhZ9D527BWG:xLIHEWhnVQBWG
TLSH
T1D1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 283ac118905fc638989ee2927aa8022c08a0eb21ba17a1e0cbab893e184fe48d
MD5 42ebaced81ded44f9e901e3e500cb055
SHA1 51e40f2d8cbdfe6f6034c0cf5bbb0f0809c29520
SHA512 e844c4fd9f521953521e906a1fd8350797291e797e5b1f028de85054ffc1802fc24ce6d112c6b44cdb5a09dce3291c4e8d30931bab94fa9c2162633573048daf
SSDEEP 49152:PB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glsDmg27RnWGj:xu6Jmdxd2dsD527BWG
TLSH
T123D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d01d8b962438340b9f4f71ba99e5baea697ef7906aa97e1c8a2b01f292003597
MD5 082ffb57ae47d3057a995b2cce5ab1fa
SHA1 f903fa8fd7e7726c55a7710e84408c3258b4d4f8
SHA512 9f4f4ef4c36d4995d68602ca26e8630eae761c8c32705434ac383680d90bc06fbdb2e176e2df3cc1fc798229d5e8802286aa35c603ab55c9f48a075fc271d027
SSDEEP 49152:11hpsNoJpF1A63U44CwH7R4x2Dmg27RnWGj:1mifPWR/D527BWG
TLSH
T1E7B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8274a5709585099ff048ec0d50a3a51d296dffe09672b2bcb0014ad5c1b5dad7
MD5 e81106a51fbd961f5e103e60cfa8b799
SHA1 dfd6af5820913a923d705588e64fd872e79fb36c
SHA512 6750c5c31db7a4c4580b19348283df213ea5a1ea6c24e421421882640e0f27a67f621cc421b9535adb81c69e1b5cd099fdc1e223f525a090b16dca2191893269
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqZDmg27RnWGj:95dKii61ZD527BWG
TLSH
T17BC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 884b3d2bccf25dad74f4dd31f904eb19493887f75427f41c70576567217ef7e4
MD5 8fbe7d6c98d31fb66e453119e888a5b2
SHA1 c1dc887ac49c28a6f1800478bf46070c0878a03d
SHA512 669676f8dff92940df76a58edc3cba4f388bc674782bd1c0b52122778603849003d2c841c734396c2747b65dc5a99f93cd4e4211c6a3f4b07d90d55d81df39f7
SSDEEP 49152:OhtSn8EApI0fig3giDn0AP5wSDmg27RnWGj:PX2imphDD527BWG
TLSH
T1B195BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3076f9588fc417ee691fd64916d18e811893ea0774d630bf36a480b158a79845
MD5 ba2a5e9a35f3dfd60e3f07bf7675a4f2
SHA1 fbc2e9ab174a148aef6b491b1c7615b301e3a6ed
SHA512 4b3a476b49b991d5ffd56a9a66c2e99ad5b5d9695ee5dd1ac9f92e79ada7aed5acea63656553aac31263d2eb36f859a8d981c815595d25f380e70261c69562ff
SSDEEP 12288:vhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1424523BF965C41CAE62648B5C3E5F10DAC073E5BE92004937A977CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a10e5260e6a7b29200d930258fa51827876d4471af1a8f3cd6b5406cdd93b745
MD5 bc70556f01e96e5dfe8e86e9ed94933b
SHA1 e0d4fcda5952735e140c9681bb3b818c88b2c6af
SHA512 50e71dcf9f0b953a0c209a125391a1ba8dcadb977507988b1279bbbc7d30b743b65389e61067139b8c632c0d1068fcefcaca25ceefedd0925c909f4bca8bed92
SSDEEP 12288:AAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BF955C41CAE62648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6d8933c054d21103bef0af970dab6a2a3cbf51d5174c7ed4068c5bd236959ef9
MD5 15f615bbbfc9d390afa9aa70fdf065c7
SHA1 9c885b285a150daec0838e37151525bb1c0af63f
SHA512 74aee16c50601edf01bf062ad4cb6903da6342a7eff4f9c545c9487f0e7ecc8058ca179e30b0e938b06405e2d9bb7e936ef6a25c223b7213602699b3805588de
SSDEEP 12288:LaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LasqjnhMgeiCl7G0nehbGZpbD
TLSH
T17D4523BF965C41CAE62608B5C3E5F14DAC073E5BE9200483BA977CBDFAB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 76a7d47ba60404c0f1c94e1612ffe0a92808c79bc705c31345961f9d23fbb643
MD5 4b9c567da37ac133d96cd8cbd77952c7
SHA1 1d51eaba58cc094756aab3eff64b10b4404aa6da
SHA512 a594fa4e920f361c7e32e8237ba5206e5a41e39b1d5c70eb38c001d9212bdbb2c1f03107c21d948e32ce82cffa539ed37a4fe7d7c973f4fc21212e6fe23db4a2
SSDEEP 12288:mVLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10F45236B675C00C6D83285B5C2F5E11DE8237D96EB3005DB6B532CADAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ea35902a76ed414e8233af62211ed0b2d90998e5adc8bb7d5bfa1ae1a500d086
MD5 677b79a244d5846f49a609b36c07d7de
SHA1 6bfc3bbfea2069fd266820822a5dfffdcbed20ea
SHA512 42e1a63545d1aa1335edd69ddeba7ed3170856b7a77227d080f74cf78b212b3dd39bde010d75372a38b88c50c47eaf40528be3cc498edeb247596a3cf49ba85f
SSDEEP 12288:pDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F14523BF965C41CAE52608B5C3E5F14DAC073E5BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4eafb84b1701231fdaaa91b0f8d58bbe3dd3e73ebbeed9e8cb8a75b429ba87b5
MD5 84583c3540d8d74470cdd7449b572cc4
SHA1 d8ca6ac20eb125f43a6afe6295cd2903e73253cb
SHA512 2f1be053a209e578d2df39fe1362973ea8767100e2632371d961135b855924f6d39a54153c679c7f275611c5819bae0dc6dd9f043aa5aa5bc05b8dacde4592a9
SSDEEP 12288:1MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BF965C41CAE62648B5C3E5F14DAC073E5BE92004837A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2d0d0a03ea4f720ef51edda104a730cc9b42bbd46d2255d07b2df3fe68ddb8e0
MD5 c3923b6881d9ba75a76488c7120635c1
SHA1 e750960fe79d61960e3f24a3412b702829f2332d
SHA512 1f6d5de8414d6e4657552b5619c9b4c5e8b7cb706205f9a54352e500c5ffd282a37643e2c5963c471308c121aae6fdca2aa1463581e616f63fdab9f41509a4d2
SSDEEP 12288:q4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BF965C41CAE62604B5C3E5F15DAC073E5BE92004837A67BCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0e323ef5d0895171b23b7817c62d10312cb46b70958af17eb92d8c41b91cedbc
MD5 1c7034d75cb9e98451f7d1f7225a7bed
SHA1 7a12a5f2074737d7095f4d2802fa1df73f4bc9b9
SHA512 f98ab7bf69befa247801b60c10d53e4f8fd2b285bad3bb93961d6e967bbb66f63df7d788e8e8b7b2fb92f4a4c4e4985b5ee36d0a31e37c64265e28fda307ba5b
SSDEEP 24576:eZMRzFVSOgsqjnhMgeiCl7G0nehbGZpbD:eZMRzfoDmg27RnWGj
TLSH
T1956501A9B39418F8EC63813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4e0e613e5411e3c4c79138e3808fa32fb232c0fa9e04e8aeaa5d2823d5424a4e
MD5 568a5431cd0fac684d4f46b421bc6e89
SHA1 eddd9154ba81f0cffdade6ec2713f129648f7ead
SHA512 cc6c0cb4d194c1a29589688ebb14cad839a0950328dbcc838b823eb47f5f282bae59f9f7ec2ff3066550ba784db69cdc19a695efb7f61b17dfd6e72be728f06a
SSDEEP 12288:xVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D84523BF965C51CAE62608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e18201a020c46481d93f4602ab29dda83279cffeb854917f2de32d3506ababd2
MD5 1daf3aa37592937b93a65baf67156dac
SHA1 fb85b9e1925c3fae62bcf5900258f154094282d1
SHA512 38afe5a21950d2d910038dcdb5c79564f286d6980d97ea9e3dbaf876ef12ec28023c6bdca2f72091cb39aa340c7d2f8ad9f2877ad2f23a6ce56d2a6d8adf9ca7
SSDEEP 12288:QpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A4523BF965C41CAE62608B5C3E5F15DAC073E5BE92004837A6B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 2f35efafefa7ab471319f7f341ebecfc5eaa9127d88a41e1b0ad0637e09094cd
MD5 9fab478eba61a2e794b72ea273340a38
SHA1 44f080bba827250d0f2fc16f0cd988ded5e3e476
SHA512 5f45d1a35e430dd0ce3cc7fe5aa5f0c4d168b541d736ea9dbcc3e297a7f88a90196a570379788764b2a98626889758814d748d3a2ec448b6c91f7dd2e959f240
SSDEEP 12288:qyPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3zy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18855125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 188932acc159eb62450227db4c029a01ded18d90b88a0bad0bbbe357b0c19b87
MD5 4876fe8ceacfc722c4ec613c3b09c644
SHA1 f6b774adf13b417590949a72edc6ae80c1d82b87
SHA512 1f1e93d9a63fc61a392f195bb8643fc13796590c7422359f71ea16322fc1df19c33a92db810828434b03bd73f1465994f229592fe26d9d8b26ec0a03b2d90b9a
SSDEEP 12288:IVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF4523BF955C41CAE62608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ed490ff4b38d624966e064a2516080bc50e8b4a155772b4bdb346b39f3f834ef
MD5 bbce066f11ec11ff9623c8bfd401653a
SHA1 ea954481b94374e0003948085182bf1b9ea21c53
SHA512 735e01384df6916bbab18ac67d25d56dd18d4b8a55d3820cd2a5a42ec47695259cf537ca48524af69beec34a43b693a83e2cd8c934fb780cb8f49b944be91332
SSDEEP 12288:9VXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9VsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1254523BF955C41CAE62608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f5fe40ee844367c6786704379e4bcf3b41df7c21befbdff1ea0754c82924c77c
MD5 0c57db3f8bb890474da27ac7caac2861
SHA1 23684acd3b92a5c3e72d92aeacb556c1c199d273
SHA512 d5d0dd997561712e04aee55d1d0b2f8cb2c0fcbc73c0af265818b009821817372acdf49f30d4a5ad9b2b808329129c0afb05bdf066e69e0f952f22e66def6aee
SSDEEP 12288:gyPz5L80Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Rzy0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D55125B73A530F9D1378178C5A29A06F7337C3647204A9F17A116BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 9faf5674d608ae7dc3aede812bc9dd11840306e242ebdacaee496dea73cf48cd
MD5 bed8d07521fc2ccd3400b5d18e9d3e9f
SHA1 86468727211690b23e31768e36e167110b8d38b2
SHA512 b2b8614ee4777649098768bfc7c242b679df959226d5a7980af438549ae6be9b463d9ca549dd600f7d82ad08f5a50c50a05d7954c5a1a462fa38855035dc9a7b
SSDEEP 24576:vTDaLl3z0zDqsqjnhMgeiCl7G0nehbGZpbD:vTuLljLDmg27RnWGj
TLSH
T14F6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 83dc43d71cbdeed463ff4d43d83aefaa743a8e0527ebb9fdafd7390c45b5286e
MD5 d5710a87e69c180a8b20aa4795fdf7ed
SHA1 35ed1fd4d0d7cec8af44b5350351c42becb99090
SHA512 d4034b17979dcd8d2395832c3bc28b8816df91bddc2bbbd1136cb5ad89fc2284baf4d23211e3aa516ca6f35187cca5e32cad6ec51ca2a64040b3dbd4f7061bf0
SSDEEP 24576:I3vd9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:Svd9CHKyaoDmg27RnWGj
TLSH
T14B75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b762082e7adf8240c3caffa12f1e3d22e4df07f8cf1b24a8e9120b54fa828d51
MD5 21c13915a44fa2c039364bd18643baa5
SHA1 d554b283cf8ed5fde266d01fa6037f7219041dd8
SHA512 74482ac8600c62384304eff9a8294d8d5aff62c12b11ceda9c350e6f8f5dcc4ebdb6e35e966d63f8baf09139146b3485f5c50931ca24c352accda9f8bade6f90
SSDEEP 12288:l6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1554523BF965C41CAE62608B5C3E5F14DAC073E5BE9200493BA977CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8162cc31a136d6562a825bdec19e1c2b9e05fc3d09bbcc7811cd2756ab77d86d
MD5 2850c98688e243958d8636a44acb598b
SHA1 20f202ea7e28da3c3c631d903d7cde88dacb5fe8
SHA512 41039119cf3750a26e58d67f2273620ae5323f615616df6ec75418f8a3cacd01d60891d91840953fd83db756936f61cc9ce0b1a988e4954e6af87c2398f4a64d
SSDEEP 12288:4UXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4UsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E34523BE965C41DBE52648F5C3E5E10DAC073E5BE92004837BA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 3f929d0f969758bf4fb23d31d897367dbd4287b669a2ea01b9dad4fee716f853
MD5 cfeb4952939b9242968b58f5b3e6611e
SHA1 b50de2d4d03409dcc071dd990435db1a11d433d8
SHA512 15959ce5c34e6ca0fc92fa1cb12cd67d5def935dd46069381a92a4f1b2cadec3b03a1c93e35e2482c77e0df52e68ca6a920d1ce8387236e06db9b4525f884745
SSDEEP 12288:pPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C04523BF965C41CAE62608B5C3E5F15DAC073E5BE9200483BA977CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8a151a131c0e82f160cf695858a9a3a999686fe553a6509768cd830e9e49fea4
MD5 e9262b7ebc9650b6f08fb0c8ca50f20a
SHA1 ede08c1d3276b6003c2b10f4512305350529ba61
SHA512 0c18b0b8cbbef0a5b2aea0a30e7c739d5f9ff558e77918e9adc42b2a9d8113753fd8ddb129d07cea73adde69dc003ad0b499fcddf158d47763e9d3c5c1c2bed6
SSDEEP 12288:GVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D24523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 832e48acaf061b6e3b28d4b62cfc42feb8a21f4beb4e6e99ed95f95ed1f155d9
MD5 77f0cd6814b455e9644f3fe882b9a23a
SHA1 15b1b0c7879a8631f72494f9200c58bd5a36da95
SHA512 f4e1d38036e28f74664b0784944a0da2d4bb856d1b40aea7ad24f285d5e730472539f2d2906022b2499e7ea6414c59ffb4eb62f7900b103a207dc8e19ef75766
SSDEEP 12288:Y6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c4dcacd652b81441b391110a65956fef9fce3d08a89e070c674f3c47d2743861
MD5 e3635029ea5dc4bb3062688b843cfa13
SHA1 3f8bd827292342b6e8bd9cd2ee4a872fa75d30fe
SHA512 a0bd3cba5c0b959fa15c53f2ae7664a030a2c36474088505706dfa882b1a105eb99c826ad531e85bfa094820b8f829552d91d9e06ecb19a49d86a90377625472
SSDEEP 12288:7tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F4523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c304cc77ab82148584ffb9cbf769b4e649a7a8dcf75b787a305d1dbc054561b3
MD5 2407592b1b109bdbb82b7684041bc98a
SHA1 1c932d5c1170fc9ba439d7c948e35dca945d3299
SHA512 47953fcc9c032f762c0eb1ce9c780da79f193ba69ceceafa10b042f5c1b198e5b4af392eb913623c6df5ee0da40d1cba88ecaa700acd0fb3d603f686e9393585
SSDEEP 12288:GDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1414523BF955C41CAE62608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 c74606303d282b9cdaf3f15d5b507335db830a21cadf8c5fdba5b338df87e2ed
MD5 4b5f3f0c49dcae9d98c221330469ff72
SHA1 34fdbcc0a0e8471e90176ae171b8f5d16f03c124
SHA512 1ff82d106a6fd253214675ae50a74fe2fc47cf46f2f02c3f15d6ae37c5b5543fe6f3e002ab6d2b5da8394735eee3186afca15c993646a33ea648787536bf1caf
SSDEEP 24576:EfwvUk9RX6wkyAIZsqjnhMgeiCl7G0nehbGZpbD:AMnYIdDmg27RnWGj
TLSH
T19685D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 71638e8ae1cc7433e1604c0ebc364f22db6350df31d59737b6f76d0d4156ef12
MD5 7bbca02b49951abb8668fc9ddb6abf77
SHA1 b41f1d088b14d14782492d191684dcee308b2a60
SHA512 c56ccec8f2733e76187c3684751d305613a6c98f1a0b74e583fece8c53f59196050373feea800fd2568cd3819b46357d13d5932e00ead85316fda2d949f09d96
SSDEEP 49152:cYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0yDmg27RnWGj:bySzPqD527BWG
TLSH
T1FC066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e9578691fcb260d31e53827fec88502a0b43095b19d9ce37f336217156d7ebdf
MD5 6b81f2c86540b8d171b3119c58b2e946
SHA1 ee39e586ae1124d7c7c256c8c5de0b5c002d905d
SHA512 aba702c5a0ce7bea45c81df1bf70c052bed15ee5382d142bbaa84c9c24369c2406699502ecb0c309f874df8beeaea0e28c33294dee02646efd9d951a10b82630
SSDEEP 24576:647Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQsqjnhMgeiCl7G0nehbGZpbD:647JUQjTirIhCnDHUPfF/iDmg27RnWGj
TLSH
T16B65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 7b0ea41c81675ec93a7af5701f4866b26f91d91b550ba47bbeef0090b69298ad
MD5 5cf29830290c37c17fe35cd10a4a61f8
SHA1 36f6139a40f6c52bd726059d0b1e6f623e89afb0
SHA512 0f95a4150a06e377089bab1ed3cd37f6562ab3de051d6404472059b2418a09f413000322f705ebecf7358d98438f44021133f40b26a0e8f4efb6e174aacdf06d
SSDEEP 12288:/bsflXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11155015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 55804cca8022835b23a94857bca16d2609075fed453f6c674d4776079d5b3def
MD5 8ebdbb9c0a42e7543d990dfe1986b882
SHA1 1a80b96d800bd5a3bb1044330beea0daa22f8bb8
SHA512 2c2273dc98713c1c8833cee9b9418e872819abe1405903834520796a0980ee7a4ac1f31cb28a718e493d1a20fd36828126a1bb4ebd84929337e2c4ae80959ac1
SSDEEP 6144:CsBC2naKK7rbBfKDe1HFd4QfKDe1zopi4+f1qIyUPSqhJ0ylItR9nzWkviDAGXns:3hoIbi4a1qIVvnc9nOAmn/u/9R9m2
TLSH
T1054516117666C75FC6AD40721E37C1CCA7B07D42EE04AB0772C8873FD5B6658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 a3739d78e17c77fbda1e436a696414b4ebe9c26d48024966f40a2859022acc09
MD5 4ab63820e30e79f478df5e25105272c7
SHA1 47ee907e5b1db5f9aa3d513a36a9e014a50a4369
SHA512 195a61d9860ad5bd9ce5382d48eb4b6909639584076d0bbfa1c2fd0da2a1e82ad02926a2b623ab7e660eb080f23d56105bc8ed4d95503208ac8c586fab40d45e
SSDEEP 6144:tfKDe1HhIjILvvcEBKvNkwZHk2XMMEyU0ufKDe1HEKDe1l4fKDe1HXfKDe1H9T0m:xmNrZE2XMMy0spgNk
TLSH
T11865D841A537A28FD1BB60B2073A5F4DB7A4EC02B7056F16738C443AD86AB15B1F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ed7511cd304da6909ef45a6a1bdecc463a97c5761b0f55657235fb0d25a08513
MD5 1768e49a43b51a42dc3bf890bef868c4
SHA1 f1d01d8f2753946cd2a9be579a5337a69bd9768c
SHA512 03019aaf1a374c7d7a4fc37a70028bdcf4ef0ec91124b60a39093884c9b789dd6e3ef3a60b1b060deaae9323e6563c1a6a0c8b1207c8b7e0ad64516316b75e35
SSDEEP 12288:M079Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:x9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19145237B934C518AF93609B482EAE12D681B7E669F1044C3B91778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9c345984dec2841f5933c89d572c9b9caedc0d9d61825948b9cbf5459cbbe099
MD5 b6a633a57a596b55fa94528475c9567d
SHA1 764a1f284d85d28a98deee94763166f03a086326
SHA512 01a9ce949042619dcb1ac13d2845d155ff7d0f97f31572334c840e6c583be3b9d5283a7b7d3b789f1f8b10e5ef46a153456404aa0b498cc59d70895e92496173
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bY3sqjnhMgeiCl7G0nehbGZpbD:ggb4mBIBhGFMDmg27RnWGj
TLSH
T1F4659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 4052dfe42428fa1e45a9feae057cdcb40dfa8c87e37e24a429568521ba8e824e
MD5 7668b6c4d8dd23e57e9a8d512cbefff4
SHA1 21e1e5230820d8bb369fdd29432effb03029acb2
SHA512 15921651da9cf8955390aba0f351e2f837e7a7c8c21c7d61e97b76d696ed82e053c5e3d62b9ab0a62f6e3a2474f8479da043c7a8376f0d30e9661bfb1e19498a
SSDEEP 24576:2G88u8FpJqH1bzria7/mgsqjnhMgeiCl7G0nehbGZpbD:d7ZFPqVea7/TDmg27RnWGj
TLSH
T18E85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7bf5ba7df2a8e8f96235cca06e239b7438bd5e23fea8d8a542d08006905b6e36
MD5 7d2f285523b2f30fcbd8f592bb202e86
SHA1 e74a635a4caea62d2404faa901a597e5b502cee8
SHA512 390e46fe4056fe6329fd40f7a65b5e60563ad8e55345941f3b2eadb76fddbd8000ff22864f380957bc84436936e406155cb7422c696640c0320afbadc20d7286
SSDEEP 12288:FHvUrBFrEjwaQ8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:FPUr+NQ8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18E65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 58c152471ebc371203b98c5c0c1ab6dc36224aab548f4fd4cf6ab5e361053817
MD5 e06260fb673a76981dea44c5b6d0f1e1
SHA1 6ee889da0d1e81e8bea3797453d55e60991088b1
SHA512 ecef886bfec9f596bbf1b2338b86358aa263d7ddb0f44fb3baee835b7c2f8c7f0baeb83f131769368fef53bf37f9552ca2ef7e3624cee8952bd1e4382f8dbfb6
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4Dmg27RnWGj:iG05lO43blD527BWG
TLSH
T176D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bef22f7010b5a75cdaa8af35864a59bbb985610578fe8dc01d1c412aacb2ece4
MD5 68fb488a3254dff091912674fd8da26e
SHA1 58b640f170d24b902bb4ec91a63cd7465edb2944
SHA512 19eeb43ecdd127526e5e53826f4f842fd10b05a2817995819f7a853be2ee762f6edb8ecfda9078bdf824cc165f9352a4c8049c93c51d394ab9896102cf330c62
SSDEEP 24576:Afa5POZ3dpuWVM50JicR2hG0lasx2+47eidnesqjnhMgeiCl7G0nehbGZpbD:4a5POZ3BJt2pasx2+mwDmg27RnWGj
TLSH
T13165BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b629ea6e9118efe85c33a653846b5c0cb1f7dc3371468a680093baa93f1e8959
MD5 659fdecdeb2a3f47893fed19a9bb204b
SHA1 bd4eb3d8e9d8d72b2819af0c82be13369052ab02
SHA512 b3a01aeb7c7a4dee2eff553c7ef2432beca362bf506dabf8db2f4ae4eeabf5ed6c22360c03b143644cf936892be4457df2e1d66267798a2850b0e9e8ff634ad1
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkIsqjnhMgeiCl7G0nehbGZpbD:uNc/zEOVHFzDmg27RnWGj
TLSH
T103857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 443b7c347650e90f273226729daf2ad05f204bfbc6540a68691c43a2af1e39cd
MD5 df52728f34868e24641c17a66b896274
SHA1 87694e305f7717d284e6c029aca789ce50a460e8
SHA512 f48d2034fe0beafcd6901e756e141dee05d6440882416820a28b00c4d191268a92245ec190ec85ed073487b96063e322435c2ec9e18cd064151025210324c3b7
SSDEEP 24576:YTkNvNnaFeYhJNtmZBmEsqjnhMgeiCl7G0nehbGZpbD:YTMwBtOmgDmg27RnWGj
TLSH
T1B555AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f244327c8427ffda24a2d4de3ba5f46b6152ed69be6780a3d378bcece6f4b1f9
MD5 2c810099475266750b23277e0a8ec63d
SHA1 a56b981e4164f5a820d4dd26fdf23183b1ff8a81
SHA512 7521accddcb2b5a26a1f8acf4b2991d20344b670b4f44cc8996782818c3615334e97fb3a1022ad7aa86b4af6b338b34892a406cc07acd6e44e2a2b842da7fa2a
SSDEEP 24576:ED3FHshBIYQgABsqjnhMgeiCl7G0nehbGZpbD:EDVHeBIAAVDmg27RnWGj
TLSH
T1F475E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-65-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1284-7-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1284-8-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1284-1-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/1284-69-0x0000000140000000-0x000000014063A000-memory.dmp

Download

memory/1284-0-0x0000000140000000-0x000000014063A000-memory.dmp

Download

memory/1444-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1444-111-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1444-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1448-75-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1448-295-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1448-81-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1448-74-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1448-512-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1448-510-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1556-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1556-21-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1556-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1556-15-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/1556-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2396-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2396-40-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2396-46-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2396-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2396-51-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2964-119-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2964-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2964-112-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2964-121-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2968-86-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2968-300-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2968-87-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2968-296-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2968-93-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2968-298-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3344-101-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3344-99-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3344-297-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3344-107-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4900-521-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4900-578-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4900-519-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4900-527-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5100-294-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5100-71-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5688-364-0x000002C08C890000-0x000002C08C8B0000-memory.dmp

Download

memory/5688-334-0x000002B8801E0000-0x000002B8802E0000-memory.dmp

Download

memory/5688-333-0x000002B8801E0000-0x000002B8802E0000-memory.dmp

Download

memory/5688-378-0x000002C09CD20000-0x000002C09CD40000-memory.dmp

Download

memory/5688-332-0x000002B8801E0000-0x000002B8802E0000-memory.dmp

Download

memory/5688-343-0x000002C08C3B0000-0x000002C08C3D0000-memory.dmp

Download

memory/5688-345-0x000002C09C8F0000-0x000002C09C9F0000-memory.dmp

Download

memory/5868-301-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5868-129-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5868-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5868-128-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6100-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6100-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6100-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6100-280-0x0000000140000000-0x000000014020E000-memory.dmp

Download