6de70a90a4e07a97c12f92af691a28a6f89da5aefcfad35a13a1f1d76c3d6e88

Analysis

max time kernel
32s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
Size 19.4MB
Sample260707-tkfdtshs7x
SHA256 6de70a90a4e07a97c12f92af691a28a6f89da5aefcfad35a13a1f1d76c3d6e88
MD5 6f26091701f0677d8d946a3c5d565292
SHA1 cb30a481c74bed68cf97a6d3fa5824620812dc78
SHA512 798c0fb786b91ec52399daaf2d361d0300beb7e7a53e9b03bc80de11e5695bbd0ecf7cac6fe7ab5608cff115cc6969a39d3b9a53315e055d7c9e05aae0b805fd
SSDEEP 196608:WJamCp0kWlaw1GCbCTsdOnIsfIOXxzNl96kZkCV3qGfxm7ym3dKnRhuWJITStGEe:kUfI4T3V/wmm4nRh9EStGM6s6tpiDy
TLSH
T1E0277C81F7C782F6D84708718057F77FA7206E05C424CE66EB947F4AEF73AA2151A21A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5876	elevation_service.exe
2088	elevation_service.exe
4376	maintenanceservice.exe
4908	OSE.EXE
844	PerceptionSimulationService.exe
4812	perfhost.exe
2548	ReFsDedupSvc.exe
3076	SensorDataService.exe
1720	ssh-agent.exe
4256	AgentService.exe
3852	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fe2c47999f43e826.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109046\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002949dcd8350edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005934fd9350edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000172039d6350edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a05a6ad9350edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a71d2cd6350edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b9beced8350edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1950dd6350edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{307C2A6C-212A-4F42-998B-242EFF16C672}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1921861047-1272335887-115070671-1000\{16A7918B-90C8-4A2B-A51A-617BB57A5B66}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1921861047-1272335887-115070671-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
5264	explorer.exe
5264	explorer.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe
5876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	756	2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
Token: SeTakeOwnershipPrivilege	5876	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4256	AgentService.exe
Token: SeBackupPrivilege	2548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2548	ReFsDedupSvc.exe
Token: 33	3852	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3852	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3852	SearchIndexer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeShutdownPrivilege	5264	explorer.exe
Token: SeCreatePagefilePrivilege	5264	explorer.exe
Token: SeDebugPrivilege	5876	elevation_service.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3512	sihost.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe
5264	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1716	StartMenuExperienceHost.exe
876	SearchHost.exe
5264	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 1576	3852	SearchIndexer.exe	100
PID 3852 wrote to memory of 5304	3852	SearchIndexer.exe	101
PID 3512 wrote to memory of 5264	3512	sihost.exe	106
PID 3852 wrote to memory of 2100	3852	SearchIndexer.exe	113
PID 3852 wrote to memory of 5648	3852	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_6f26091701f0677d8d946a3c5d565292_elex_gazer_glassworm_helldown.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:756

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4376

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3076

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1921861047-1272335887-115070671-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1921861047-1272335887-115070671-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2100
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:452
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2860 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3520

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5264

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ae31ba93d3e40e415e12200c4ce6abe4ccef4b6b736347c16891248f69962c25
MD5 9626663cf4d68da4c243ddf5c59a8db6
SHA1 86adf860a8373753a7b147948f0d5f7a18651134
SHA512 f600ecdcd844d5a143622cfae06fe62d6ea98471ab9c3a6fac2f8eaf1d3e357ebcd29228a3abff1c11fc40f7a012a967c6df10fc72de7fa739ed313d9a22602d
SSDEEP 49152:tb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn4Q/lFTjN4:z3q6HjBYLm
TLSH
T17DD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 b3499d9dc060d27cf2343c84e908b930a5746fbe001312ccc2faf440dfdead84
MD5 4e6891a63952fadc19fdf99eba249fb5
SHA1 e4a22662d21f2df4d711e776db0cf5b3e26ca9e0
SHA512 f9fa4892240ba6c1090e9173fac0dcbd20ef40e4ad4c964349e28e4e73ff38fa4992d9ad2dc8b97ba576b331fc0fa3cfbb4738c3405695d8a9033b9208f0bde3
SSDEEP 12288:61XLsswWkxy2lRq2czAnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:QXYfDtczAHnQ/tbw/2Mkjy6Fr7g0of
TLSH
T16D65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 6e97e98011d4841d38631925d50fe7c87de0cf87a0a182bd469cfcf34ba482f4
MD5 dabf642c0fa3157a64b32daa65f737f1
SHA1 ad0d3a39c08a40360080e945a67ba865df364de9
SHA512 744bb8eda44c0eb7b99ab406d5936a404ec3fa9d6de5949fffcd6ca21ed350f0796a0b1b1ca2c34e2376252db6558dacee20462ee161c9925b49bb44d1f2493d
SSDEEP 24576:60Le5ji0hmxLrM5nQ/tbw/2Mkjy6Fr7g0oC:6Pji0Al8Q/lFTjN4
TLSH
T19A859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 62bdb086a4d048504b12e02caada50f33858ef5e9001817dfa7a91a17392e193
MD5 821a19639fc5b851d853fed98ddbaf83
SHA1 1f994ef9a16774d52a93d8d9152f614a85ee6b42
SHA512 a94b0f2b83b6c810f1783ff23c50efb5f6c4901048114537dce96e7a00d9f248ca6787d1d1c08a2cf734d6183d378da5e3bac1b45254a0f99501c82f4c04d726
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuXnQ/tbw/2Mkjy6Fr7g0oP:W/ezSC6vUzPvxHjyIQ/lFTjN4
TLSH
T158755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 19aafc016646148a19bbcdd02a628b7bcfb1d9f841f246d2f6d8b9135e1b4af3
MD5 c15eb93298ae2e73bde445bf0120491c
SHA1 1645c47307f877ec1791440f101d5d7fe96dab3e
SHA512 2a977404a7804e1bebf2f5911204f400c0710375d44753526ecb48a8c96477bcd8387b1f94d2389c2db8cb478a6d5affdd36a84556ca6312fd39b8c6c746603e
SSDEEP 24576:gVbqPb88hv/l+6unQ/tbw/2Mkjy6Fr7g0oE:gVO88hXl+lQ/lFTjN4
TLSH
T1FD559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 14402a7c3d78f2835c6c9b6327f752a900161af7ac5f65accaf3c49e6c515217
MD5 d194f7dec3537e895b20a9eecd68670a
SHA1 38be8ca38ca48ced37319fce849f17e0632202f7
SHA512 e6758e714c8b450cf80d83a5f3c339094676995ea82886a79b2e838716284953391c2c55dae8943fde38fc23dd933ecbfe280d5a1da66feea54a6bf207070176
SSDEEP 12288:bz9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:bzdnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1DC5523796A14F89BFF2B06B15C8384826B7B0EC1BFD0A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 11a3a998f47130a5c47e153dc5d0e935c610313e09a4c5d95fbd6a02c56e1727
MD5 9037430a17ca98375f7a40173aedf7a0
SHA1 3e3ac0eb48f50c5270ff04729e1fb001683ee82a
SHA512 a95af414ab3d930cbd623139345e6def07506536f1cf2106f15835d8993d97ebe0713f1da3cc440b583f3b64b2df9f55b6a4ed782f85f2a47880ff7cc2d59007
SSDEEP 12288:0eBNUbTVO86UWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:0JIU2nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1B075CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 62afe90fd80cc0c6cc5acd871f9eb090a8ae1ed3f4239b15dbb413720b45b5a1
MD5 76fba159aad1177817f430e539417e93
SHA1 76638e27143df1cbac0ec1ce2a242992001daf82
SHA512 f440141015e8252aa1b9abaea31746739b8b3be5ac4ec77d577b007e88fb291f58265af229cac15791ccf82f984006296924d825ed7148928314cb45373fbcd3
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:1QvGAdlCEL8c/yRNw5CsLm
TLSH
T17A267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1fed917209acaf12ebfb5d16dc40f538e9dc88515cac71338c3793f51cdf0eee
MD5 c1ce5c33656bf7202405b30b31a4ca7d
SHA1 f602dfe0fdf29d274a2d1983ad2c3b4d8c4c80cb
SHA512 2e91347a89f1dfe6fff69b01d74a5ce65e77a7ffedd40a5c479cc497da2133b206e66c6c6d23fac5aee40be6c6ac4b4b144bb6b533a41b625f80d0ca57f08dbc
SSDEEP 12288:wAwSfxL/2Dc39DLLmt0LDQewsAjsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgm:FQewsAjsnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1A675E031FE74E436C77F0DB21B22C706593D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0d1461c2d19712f055f50c0edb1fb1bd4ac006659157d7844e435d6df297e771
MD5 5f2f738984ed0f4be76992c3e3f7d946
SHA1 c6fac32db4e26b2a42e03f1f2e7f2b2437f94965
SHA512 d5240e2d50a77bf6179ecccf1d548a65b7dfeed4592500f4cb9c665b282c1fa1587ed4e1bf67ccd2c2b0d7fb214541a2c8b43115b80ccc449eaf6205fecbec31
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXL:TUEtQevvqc2W1cpV2EI32
TLSH
T1E1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 174770f4f39e3b9b18a0355c975ebc2b788d5d01240f1288cea8eaba4dc63724
MD5 075e2ddf4777d94ba57272da4937b260
SHA1 178e2d9d2e90e7f85817017d93dc732a6952b559
SHA512 f7eb541da15036f00251c609ee6f2130a82ff5b061df45543e292a3c26dafe8da300300ac0cb486c8ea4f903fe3a857ceca6e830df3c1b209584f192bad6e42d
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zMQ/lFTjN4:EoqtVjnm4Lm
TLSH
T1FFD58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9ef1c25a081308356a6d1339f0535d8574d20709a30f487ee749376e808fe6db
MD5 d6127ca2d53fd25acdfbc4378a2e9a66
SHA1 b5e257c9d4b530b3482f1c7979a8cd7eb604c908
SHA512 cb8eaa9bb57380b67346014d4253c3f6df18a12ea64f8483adc6aed7666c3f3fc553bce11b969a2dc3ec90dcc3645a6f8ff1ac0096df38673923258aed5b3420
SSDEEP 24576:0AhGLJIFoiwtA5l7S53znQ/tbw/2Mkjy6Fr7g0oa:0AMyFoiq5DQ/lFTjN4
TLSH
T18A35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 2796683d9e5cc7e6a9156cac2af70c0002002153321bd38b80d26e70caae2a52
MD5 71dfa434351aa97a43e3c3bdbe310abd
SHA1 fd69969e0caad678c6165513a05620977d7e4cb1
SHA512 a1e2b54d819d2e4e0c9933444331489a3b2a0d54725eaef4929e585da53dc247b2c128e56c8c967343b8a4f3234bbccafcd1f6c6f6affcf0bd530ffae95739e6
SSDEEP 12288:pmw5HEjsChN2BFgl0WDm+CeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMY:kwuHOWlnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T16A65F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5aeb466014eabb2278071081dd9a227235071df181be4a0ad4f4eab282dbb7a1
MD5 1561845d6613a97fa58efc807faf7342
SHA1 ee75d99c839f614e8e9fd64f10c0122e48a5cffa
SHA512 823db4062056847e398ec578f39847b79ae81b5592ba358101f0c53d110e730b9c4183539d8bd2fd3a177bb5fe186f3fd77af13e8ab4175d7567c323c2ab2d25
SSDEEP 12288:xXZ1IycGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:5ZuBnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1CD55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f29ee7b316112721ff88ef5eab52d93fc4af28055a4884aad83449fda583ed0c
MD5 92275941ec713a9627dff162044c41b4
SHA1 ea784f1f52fb9777d034a96b518ea4fd28793740
SHA512 e6d4b97166c5595784d5b63c9d2c7fce404d1e4cc859d09fe283d43fe3a71f2f21d4b53b9b3fa5dd47026858bf2a01811b82e7dc578d4cd461b5ead532c88a03
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:vQRQyi36YOcPQLvw2gAf+PN3dLm
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 551d1b2e06f99d22b4cbdd8bf6c6cb66b9b8a1e441d1836e808a069b7a1b8007
MD5 1a72240774baa1a6c937626df460e374
SHA1 9779201f7c1161031fccb31b7da642e2239f13be
SHA512 32b13d56a275dc053d5a60330bcd5fd14fab6c5b7add6a3dfb6a1e56e1a2caa2c5bead474da13558acea7ca2aa2d346ba273e690d6410e7d20e036abe0bb0204
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UY:7QRQyi36YOcPQLvw2gAf+PN3dLm
TLSH
T1DC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5386f9085f9621ee9893ec833fdd3a003c3825f8e0146222bc3ef883ee162652
MD5 95f28a1428631f9ac78b2b3abec8de0c
SHA1 d1ef1f4982a2f50f443f5284bead80c33409d792
SHA512 57055b8e4ff27c07609f577e8c7b5f155edb90d2b1b62a74bd5ec472a715569db4ad6ccf56e9c2c27527be4bd250d7e5bc56d4e60472b0ed0adc956228552faf
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0RnQ/tbw/2Mkjy6h:g68Qg55nhheWu7PNU3/8Q/lFTjN4
TLSH
T107B55A33B2F60099C44DE1769F46872196E27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 09e682b3c71d9100b75330445497cdd255cc5905073b309f5c3080a66ae5bd7c
MD5 66776613a501bf488a932662ccb83fa4
SHA1 033d03911e6f9dcc9cbf515ec2ccb727c54b124b
SHA512 655a91e912fd3058724f47f52a7b6cdbb33fb66246d2ea68282810402f0253156b87ab75dbfe102439b1b3c1557ac3e6b0a5abcf96c5d55beaecdcb44a1da73a
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99S:5y5112gYy5azzVvL69nLKnhZSLm
TLSH
T174167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e2f58344ce7359759046fea3b97905260d896cd604f0dac0cbfecd1f2dda432
MD5 33a03e9a160ebe7da2a3c222c5fc17f1
SHA1 5e1a0058c00e02ab5bd9a944c480904fe69e16af
SHA512 9a2f18b6b57910dd455b02f560bf49a07b71d961ae5f6510923844b3bd0d43193c3f1fafbce2af9cf1bec5bbe74740d17174151503759b340d3d1184534fd9b4
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glXQ/lFTjN4:Yu6JmVxd2d8Lm
TLSH
T173D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eb4611a4364294116e809c51e7fca2ed55fee82a0a5d1a76c315ccf38b65917d
MD5 a839d72b32fe29c6f165051a68df87ea
SHA1 cae7356ac4428adc8029be41c6d5954fd50062f7
SHA512 7d3131bcf470d703843f3522436d601507088930f53b66db88f95980f4d8023690f79f7ad99d49364dd9ef02acdd98ad7da76ddbeafe4b9af36ddce5efb2afc5
SSDEEP 49152:o1hpsNoJpF1A6UU44CwH7R4xWQ/lFTjN4:omifPbR4Lm
TLSH
T188B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b426c09c6b72e9647db8d53f6f573f59e68be238f55b9c9691c752f1f8bebfa9
MD5 a599219caf6fbe1d7e29688b28bbdba1
SHA1 a82ef4a780f716f547f8bdac1d7bf30d0f67c97c
SHA512 63a04211686b6e94d7eed39ada000fc1b4d69fb4f834dd81691d279cb8cfd473d45814fe845cf04b714b939632b59626a143eb84ddb07905ca1fb665f5c1d5a0
SSDEEP 49152:1SuZQIY0Be2KRRVtOnks6NMHqBQ/lFTjN4:b5dKTi61mLm
TLSH
T1C2C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 30afdb1d5baa35b074bcff6a79369b830f726d1d906d6b5961c5a0997ac968d6
MD5 c3a48705b5ad32596b6dcc35055c31ad
SHA1 8b985994a2222d1a581ee673fcf01e9bc03612cd
SHA512 76e6d6450511398431c0e7f31252f1d90bd4dc66cc7fd14d79fd1f832977cc0e983253d5844be18063c26aa172f45b5773d9b26705aada6639a027101d151e10
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wKQ/lFTjN4:AX2iyph0Lm
TLSH
T15D95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0d86cd64ce4480bf5cf681d4f6ee4008b736cf47bf5a5aff4220e1f744463b34
MD5 2714a73290d6fb9b845fc096085f5915
SHA1 015abf418795ab4bfb4fb529e4e933d3ccaa60c2
SHA512 d9210a47a5bb3b5c310bc87e5c1f492cf7aeb1f47c1aa91b88bb75d83aa10d6e7d240a7fe99bec206f0c80cf43053dfd5f15d2f82aef7653742d13d0fc6d91df
SSDEEP 12288:5FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:5lnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1B35523697954F98BFB1706F188828182A77B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e5b69f25931f34a21bbd69189684b3366bda0560e609a8970c209f30deea3619
MD5 863e25aa5e60896108afb96b7bb141ee
SHA1 534407c13b5d9afc00330d0145736bdccd0123aa
SHA512 1c3628708bbfd6c7f40855ee87d3c7df2056f3fbbff25a53d6d484d635a182f1ed49bb0451b55cbe6678cbe25f138a8cded52578fcc324ce427c717560eacd85
SSDEEP 12288:TAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:TgnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1DE5523797964F98BFB1706F148838182973B0EC6BFD1A38F7B482129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bd95a94d0442e9f81029bd6f2873f739c1e6b1f126c72677d1f86e2e2e40ae34
MD5 18d9e762bebdfd08998b4630b39063c5
SHA1 3252284a533a0ff22fecc72d504871f75ce3c2b5
SHA512 273ac2f8ea250c46ea70f238985f00ab5459c9c0674bda5cf893a067409ab14f67dd3c29028ca8c6ad61804fda93b56281392d8458322111dd03079a763d606d
SSDEEP 12288:w+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:w+nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1225523697925F98BFB1706F148838182977B0EC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 aa44a42d651d000b42fdfd6932433d1d75c545b75416d9f93221d414c579f235
MD5 68f2aaa54083e665247c895267f76894
SHA1 e8bf4983ab164ef4c2ee50485c2a0af9545d51e6
SHA512 04b3677e81edd1330e5130ef8cff91c0d9fb7820a00a58bca225e76a2f7ebe26476263b396f9b98abda1c748848d621bd0b6537027009f25184895ee8e1a185d
SSDEEP 12288:dVjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:7nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1BF5523693A69F4C7FA2742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f9f99b45fd3644b5f9ddfff48cb23d0b7b76b461ce820d8d0fb68f9bcf56e2f8
MD5 221820fc764ef123ceecbd0ce64927a0
SHA1 cb471412da1f4667cd7937aa346d783d167b1e02
SHA512 af381c7e93ce0e564f9d5b3b1f8ee5691020f959c25db6a859ad3678b92e25358d0f2905bdc7b242e621156e2c89b0622edff884b8570877fe5f11a1874067de
SSDEEP 12288:FbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:FLnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1B45523697925F98BFB1706F14C838182977B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5cafc8d52774a636c349dcf5e3a370bda6b302f4fdaacbd64d252538dada0c5f
MD5 d7747d624bdb84131da7cc0b9934d2ad
SHA1 f3d1e7dd2a448673925d6bc07a6487cf7f1d1182
SHA512 5a1be5381c74788daeee534bee41e7e2892125f385f31625a6f12437410a48070953802985bb48768431beefe212101a2d187d346e0e90ad599caf732b63371e
SSDEEP 12288:c0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:cUnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T12E5523797964F98BFB1706F14C828186973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6290e8c40a9576376899c0c1ba3c4d31cb11a6c6e78290cae1467d65eb3e17d1
MD5 c2b3aab11f52838ffbd03da9c7d76791
SHA1 cd51af909708a81a30374a549ae7011acf97cebb
SHA512 97ce2f2bce55b3e82ee4b38e7aadc45c5804ed009ea848f6bc0c9556611d6afa497a03acc0f25d4aa0bf63ffa7cced610af7fbd94a29a8a634d4ce8dadf598b1
SSDEEP 12288:84GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:84nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1CF5523797964F98BFB2706F14C828182973B0EC6BFD1A38F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c3a9f8d86eb9cdf0db57a8e5bbb2a4b98232a476ff2b241be79eb99763325dd4
MD5 48b63413bcc5611efd1e2822af544a7b
SHA1 0b40c275aae1dd792fbfa00bbb8ac95ef1996817
SHA512 aa9d53a8a9975472972dd5ef26e3a5e1246682261ae2bdc707f206f3cad3a0ef6bddbc594f9cb9d93aedbad2a2c397efc9ea1e8286868b0deec8165c4012f192
SSDEEP 12288:aiZwbDzzFEoS2cPvygGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:9ZM3zFVSOAnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1AB7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1e3359b9e29f49a25cec4be563e881696bd1f0cf0c8d18297d58a5453b15e733
MD5 9f749d0bf401f71c1cd5a4cce2fd7151
SHA1 5e822129557d69baf2a8ad7f8ce84c2ca3bf5710
SHA512 bf981083856e0270551b0213ae179357c7acc635d4b69ae0211a55b82060359c1254f31626c370381545d6946c55720cc7dba27744ec2fe8a8e44c355ed5d172
SSDEEP 12288:zhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:zxnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1345523697924F98BFB1706F5488381869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 052c44626ed36620aab7a0901793a0c570c1ac09381af7329eaa99f753b80f86
MD5 e7dc6707df36aad7cb2507c88dcdc40b
SHA1 dfae47a9202813e8c51cff43abf5586b288e8bf4
SHA512 80a40e786f2194871a2bbfdc2becee288b1985c6a5ae4bda10982ac95722bd47f003aba7dcabc49d1cf865f1661510881cfb25db997498cd6ad405347eb57c0a
SSDEEP 12288:ftGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:fNnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1065523797964F98BFB1706F1488281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1af5849c8a2089a640c1fb1f58a9a68f7f0933199b97b163302204e2a0fcc231
MD5 d7b59a5aded783f43ed7d747bc1e0c13
SHA1 8c8f83ef4e444a394dfc811afff083aad435a780
SHA512 39fb42b3e6a123f9a689dd513e2c9dec84a32f98de12ff5eff2e91c5fc943ad2a77c766c4a3354846674a2ee74f321056f34c1938f0e60008de4cc00fb1b0847
SSDEEP 12288:zyPz5L8cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:+zycnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1B265021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a8d2b5c4467283081e6ff772cacecb32c57f72489392c705b7e60a0a650935c7
MD5 750313d32e51002a431dff4ae62ae390
SHA1 5018ac5e5b4d5dfbee1efd08527eb97f77a15311
SHA512 14239595c94bff88f8a45b674bf7ff2511e875141d3b20d698db905658dbbb3f1dba3ede17de7bc8181173b28cbbec17f2198faf558af5e969c09d853a7417fe
SSDEEP 12288:yhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:yxnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1765523697924F98BFB1706F5488381869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4b77e0ce0a9ec48dabf1c6c46fcb2a0677f0e835aa002f5d3ce8c722c70a7adb
MD5 325837d912ad62cf5f573ff0c62b7dc4
SHA1 d4bf6a308833dd0b6858ff1f6a1ffa8d1c7f881f
SHA512 3d8bb2f0a9e4137d9ed2a8df8fdffa267c60790d8a4ec63ab616b249aa31beff92d84dcfc4dc142d36df52bcb52649ae2d222db70f88cc77eb198b09979de407
SSDEEP 12288:rhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:rxnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1265523697924F88BFB1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a6fadf4e44b26714d333740623b174c7d69f0c24166139aaad78cb27543b9f4f
MD5 6dcefbe06fe51c4e3259fa31b7289cb4
SHA1 80fb3a8e563b7aef46edcec5a69d5adead004b63
SHA512 3fe2e7d8fd6cc14f252d14523ddb481e6e386a6b49ddbc23d4bbd7b211776687629b1e4ee2b0f7c4815be7b7114adf41777cc48390aa46adb07375a28559a981
SSDEEP 12288:0yPz5L8cGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:tzycnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T17F65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f329339cdbc3ea365292204b62c473ef6fa53de27e1d026393fd9458616acfae
MD5 4d407aab1193177401bf23fc390baff5
SHA1 ec689da44633378bba1f158b17387f39c041cf8a
SHA512 aed26f1b49717083a1e5ee6bd1388d26670106ab5a0f6de5d7c4330ca02f87107601d1d07de0dcbb443e79240f19359ad86a774b3ab8abb67ba605b82c8f7a9b
SSDEEP 24576:4T0aLl3z0zDOnQ/tbw/2Mkjy6Fr7g0o8:4TDLljXQ/lFTjN4
TLSH
T1D47501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 05b1696bc3841aeaf3a07d862f1b61c1304979a3e0a2e55cfec443938e68c7ab
MD5 85282384484e4bebe91dc5f15ed4fc54
SHA1 a319608d737217aedcff6e65bf8d978732d0c07d
SHA512 b69682fc30b4b5d5146f5dc759f670b3b0e17653eb157d0cd7c5dfabfa52513db2eccd34059d582aba3e308b0a376c5fc20967ac34e8db546e47754bfbf746cd
SSDEEP 24576:C31d9CHKy7GZynQ/tbw/2Mkjy6Fr7g0oq:k1d9CHKyaEQ/lFTjN4
TLSH
T1AB85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4863bef008f1db20169c65ee90d59853a57781e208cd141d0e7b5d3bf2836312
MD5 4c8e684adcfa0d5876f10e7ce5c198f8
SHA1 59d4b54e6d90b029ae57b7a563438f3313bd1ac8
SHA512 b98629abe1d430fb634dcd791f2ec23116c081a705aadab53fcdf1db06fd1882f2bd6ac12daf571aae61d01e209a599aa6ade2beee919ed3bd78ab75450786e4
SSDEEP 12288:4eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:4enQ/tbw/2Mkjy6Fr7g0oT
TLSH
T19D5523697925F98BFB1706F148838182977B0EC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4d1d08af4e3a512aa9738b89772e9dd9190da0dc6cd5aed3871ea215d2a1dcf5
MD5 9c7d4e5049ae5a801192af283f18feed
SHA1 0aec7629887ad610b0475f37440657aca42c4746
SHA512 98f24a4a8929ab76a0b3a67b1b8a17268bb09441bc6bba524d317fbf3ca0317d26ce0425340db52ed90f55c7564798d1b3964db5166cfa9fdb48c7dea5a8a8dd
SSDEEP 12288:I8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:I8nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1005523797924F99BFB1B06F148838182A77B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 868506149e5aaa9b78f3ed73677ac492c987cc57e1013c4a6e4bf74e4788b59b
MD5 5b8351a7721d601b4fe0675d397bc99e
SHA1 91dc0143399a6853847db9bf8089cda7486dccd5
SHA512 ed73900bad1e908a063c634c23d9562e25c41024125941305d9aae790745adc2dd43bd5ae92dcc8a2804dba93e1e2919e61dd09a84559dd3bdeb3cb191218649
SSDEEP 12288:WPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:WvnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1CE5523797924F98BFB1706F5488381829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f0b41207eca9a14483c235b9d63bf268e3305aa4627981cdc2eeafb14a33a0ca
MD5 ad6af580bbcadf476890dbc267399488
SHA1 f4f4ef95f2fb93393c64afc9c80c8e203d78d5c8
SHA512 9fedeee6553857eaabadf0a01bfc8cd81d12052779fbcfc039e41fd9c30fa1c60a340e67b7222e72fe4fdfa1256ce499b21d0cfc5d5e51cca5244b7029470c36
SSDEEP 12288:ihGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:ixnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18D5523797924F98BFB1706F5488381869B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 84d92b82ef49d7d675c58e8c7cbaf643b36c7d1968acc06ec3f003c4f162faa7
MD5 73caf2fa101d4248ff48177fe1b12575
SHA1 1cbe0ea526cbfca5f744bc7223a8183a1bc6d0c6
SHA512 ca077ee7be0c10d7b6b030640e37325343f1752b087821e71b99c942ca5486758fd0ee0d84ad5746afdcee628c54b5979b6892af5e02778a93cb67b1f7ebfc62
SSDEEP 12288:yeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:yenQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1FB5523697925F98BFB1706F148838182977B0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 19baab0c98e208a5cde9f94bdba2aec046a5b62341ceb66e904efcd049c3bdd9
MD5 c3871f4870daf3eddd0a65f8bfb6e9eb
SHA1 f411d3da1f18f3d5742a4ac816a6a53911451fca
SHA512 1f4f0a3eaf2d4252424ddb63d593dddb60e1eab58f26515cff7e7a8f822585e20bd582e12daedef8f2f56bdd4c96d15ae121fad0bb8987d31c58ff486ec88344
SSDEEP 12288:M5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:MJnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1DC5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e52a304c3276431b6b215ac1d3f8fae339194cec88723923ace7c0ad2633ae53
MD5 5c67e62d330da8c4c6971e9a0f86d0b2
SHA1 bc42de3a85bbbc47754e16d8dfafe9a0488547a0
SHA512 fad707497684b9d88f43cb4794d1108eead0e77d309d27315d6581cdca3d4468e7c51a5405027b3801a6842695173949e9bab9a0f8387106f23d3c427f30bcd0
SSDEEP 12288:1bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:1LnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T18F5523697924F98BFB1706F14C8381829B7B0DC6BFD1A38F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 237f91d1dfe9d9f9ea534c57ba5def0c9fb9a377854b141eb1f86bc50930d682
MD5 2341041f1d6d8445da2766ad68c1aff0
SHA1 256c75ef57f0d8eebc3a696e3ce95a6823937520
SHA512 b7140f85cb4808c4d60816c53a2cc85b958178739629ebbf99ab3fa23ed611c48556adf072efe89e33339b3f8bb5fb5d1a94085c5811ad9669495465756263d2
SSDEEP 24576:Sfwv/k9RX6wkyAIcnQ/tbw/2Mkjy6Fr7g0ot:JMnYIcQ/lFTjN4
TLSH
T13685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6aa6397a0c5658744c3db27eea45015785ce333aa25046a3b29cfebda658c120
MD5 0aa6642bb048e8a71ea3594a43dea853
SHA1 5d0e52449c9317e06b90c6b60573c834fd6a6f44
SHA512 df6fefd07191040090dda8ee1f1d660a84fb65f83afc1a00e5493b6399d7338ed093bee2365f18a89b05479b804bbd79b5aceca7b9c40c73338081b0679a2ddb
SSDEEP 49152:+YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0qQ/lFTjN4:wySzP9Lm
TLSH
T1C0066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8e5be663bc2a99ed1c0565c092d1b437ff778a3fccdb422ee8c0ba9040ce0ce9
MD5 1c548c62ec07e0665c44800fef9d38d3
SHA1 9c2d9ac9b14ca8e2aeadc8c0ff03478e4ba82566
SHA512 dae7750759fe32adbae13fbef784fff543c5f04f2fa47263aca8f40c128946d40c0547577b66d842bddeb07e29d5e043b1b644a2c739f63dac4c69a9aa30d7e3
SSDEEP 24576:m47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYwnQ/tbw/2Mkjy6Fr7g0oI:m47JUQj1irIhCnDHUPfF/aQ/lFTjN4
TLSH
T1D065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f186b5cd4cdfcc10007b089f9f92fec1c851b12542b3e7cb0ad8416d97c4e11b
MD5 61dd77e9bab8e89c4541621fe814b841
SHA1 dc092541d34da9370338e95c21c607024046c637
SHA512 1492b4e17f864f3653076c39168bdb30c2008fbd6116073d5021b6a565d85c076cdbe93824ef839730dc6f32376fdbdbf865749ad23305b88fc900e82648de56
SSDEEP 12288:WssfxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:wBnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1CA65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 6f37f13c3a5e928db990af304f95fad2ef18d24041e5c0fbc45ca3b11d3af9b2
MD5 1bbde7c2a410cde04077b4e053e149d8
SHA1 7eef3c374ef06321d3b2084062ee9a841334bee5
SHA512 12c9be52362ac4ebeb4b112732d7ead7a03369bd64558e63288ce3454bf5abe131ed3745c6173366e06190eab974a6a0b7a0704ff4313a115a98105774677acf
SSDEEP 6144:9sBC2naw/pTLWuwGEotMxWwHQQHEbQ/LImuRaoOItxRi1+M/71tliS04aRucdOYX:qXLCEbYnuRztiTjXaRuKB14AD42a16
TLSH
T1B74516017666C74FC6AD80325E33D6CCA7707D01EE05AF0773C98B3F9576658BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 905KB
SHA256 a7c335f422da17f27f88ff1593bf990ea56afa1196b32f6eb7f1b516c1161301
MD5 bf8c92609d054294b82dce6274a2f99e
SHA1 6f6107422cbc4b5e6e2eb6776b8848fc909a3940
SHA512 4065a73d9d2b55fa0d020ade0eb634849a94ef3d9528e648ea868e31f99d580cd757ad52531d5b4d5a088df9f74dd377e1a30045155f67754df02fb2e91dbf93
SSDEEP 3072:C2PDFIU8jhMnIyEqthGibW6qqni2VVLiQlOw:CQGqiM
TLSH
T1D115E7409BA7E34FCD7EC8B70572968E9B786946BB5137002744D8484CB66AFF6F7280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 94563c931638e5ca3eabd83fe2fdc19e66c3a803533fcaa2c896b1abb7c29935
MD5 95ad3fa09ebf6a1c6c6ca9e704407185
SHA1 22d9a42e02dca3d86ad1941ab2c80210ee3260b6
SHA512 46e5c33a83d573b0e5b5419f8d468f3f2c59d20f32db097b5246aeb3823c446e2f6c10356f403fc01e6b0e3c7e32774f34b29f4923425f18c76dbbb7f1f7e3cb
SSDEEP 12288:b67QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:CwnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1565523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e90cbefeace1aafbeeefd0ce468502435e34843e416b5c576d81f425aadd5f9b
MD5 48c72c724abeed4aef694ef51ddbcc34
SHA1 39890100fa6127c7f8febd900b7d33713ecb3d55
SHA512 0c973cb8a0db198e6ea6b0c20cdc1374b10f00237e7543a4ed9b6ffbe092650a4a3ee83712ea0338159754f484f408b5d891359470484684ade49a7e6ef0f791
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYXnQ/tbw/2Mkjy6Fr7g0oR:3gb4mBIBhGFwQ/lFTjN4
TLSH
T1DA65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9744282704415d0cfb188b009efb1bcbbbda0a1217b14d6417c4f55ea6de6f30
MD5 6842ee5dfbf540a2549831580b74dc91
SHA1 b9bc75dcbef1a6d1d59b941796ca60d39a5809c2
SHA512 c3b8dd11fc16506bb41f63c2c465b8bd7f8fb06edc2dc042db18f0e04dbdd12ebe639b4e8b4e66b565dffd183bbf964798cee67311b434041b4682196baacc31
SSDEEP 24576:mG88u8FpJqH1Qzria7/mtnQ/tbw/2Mkjy6Fr7g0o6:t7ZFPqVva7/mQ/lFTjN4
TLSH
T18F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7fd9366df44b24576e8d50009e1c456b8f71b75b399fe076be57e18f2460a226
MD5 fc10a917e2477ca83bfd379ec74b54fb
SHA1 47977c95b9993b8abae0ca0e4b5c2289069a06b1
SHA512 9c12107ff26a39ac9d73b109038c6fc83c63dea74cd134fb4ff74b0899b0fb775889fab39b2c6a21c1282e265b05bca17491ff27cc2d98675fdd58ad6e82237b
SSDEEP 12288:wHvUrBFrEjwaQpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:wPUr+NQ5nQ/tbw/2Mkjy6Fr7g0oe
TLSH
T19365E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5390f3b9eef3d9c74979706c74d0288f4e531f5910bf894c17ecd11cb1c7b39f
MD5 db3a7ee68ea65aee45813264132d33c0
SHA1 e05c79475816a0f0c8bbc2075ed3820f8692f0c4
SHA512 ae84c9b9dc35e0a61a08e34ccaf0018fd41053f79783e1812575b8f799800300f505bb5754d80d4659975394509c01a9b25f070b083b2a7b30695f02bb3ad7d4
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjJQ/lFTjN4:jG05lO43b3Lm
TLSH
T195D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0a172446f121438cd929596e1c8276a632080c8e7f6a608f3447b91b29159051
MD5 ed107ef4f27a8aea817e3fe50a9fdd37
SHA1 2d72139e62bdae575d35718f0413a7a1bc27cf2e
SHA512 aac8d79702f6d730f7000f6710c31f09873606371b378708985730a6ffd29688ddf8bc2965f3d836728e86db5013118758e9915a46d12c70fc60803250e792ec
SSDEEP 24576:bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqnQ/tbw/2Mkjy6Fr7g0o4:Da5POZ3+Jt2pasx2+m8Q/lFTjN4
TLSH
T12A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9669b7a52803a599e08cbd408aa4da4968e8ab0af74fb89b49faaa14d9c2de58
MD5 b2a41d0978ba0964a6c5f19e5a36f4fb
SHA1 675b8cb807a611c10317678e11f3205d5a718d1a
SHA512 7a20f0e926b02ada4e436be188997c00604aae970609af725a674be7486e1500ec274012a6b713d697f59d02d8e78c015a05ec7b34af84ad35280c29b9b3165f
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkFnQ/tbw/2Mkjy6Fr7g0os:PNc/zEOVHFGQ/lFTjN4
TLSH
T110858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29cfe2a954220c2265fcfb0388f3001f0a7d886ea7e9813a2181b1fcb36997b9
MD5 33e04f555fb85b4b231db356a503b99c
SHA1 5da9aa22dafb03031f5969f6a854f3a55715acb0
SHA512 7c3a8ec599876917dffa06f8612b2363cf50d08274f8bad9f3cfb40c7762a65f2ce81b43a151d7eaa74716655f36f9441d729639ef4b5481bb5ff05cb3d77058
SSDEEP 24576:C8kNvNnaFeYhJNtmZBmrnQ/tbw/2Mkjy6Fr7g0oW:C8MwBtOmrQ/lFTjN4
TLSH
T1BE55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 eb0476e8f94dc334ba749d1d51524e8f9f13daaeffafe4a59ee81edc9a07838b
MD5 b28d721608df909f21e27ff43920f20d
SHA1 d01d2c2cfea8a0023b675eb3a592f728d82cb2b0
SHA512 eac2128ca1c7bbf38db3d736a38a458f60fa9b11c455fda6d3523562dfd1831d0be156081c2b8f22b239803bce4b7e4aad92f7de8c637198e940328537f92c7c
SSDEEP 24576:GD3FHshBIYQgA0nQ/tbw/2Mkjy6Fr7g0oz:GDVHeBIAA0Q/lFTjN4
TLSH
T1BC75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-13-0x0000000001C56000-0x0000000001C58000-memory.dmp

Download

memory/756-1-0x0000000002150000-0x00000000021B6000-memory.dmp

Download

memory/756-112-0x0000000000400000-0x0000000001D32000-memory.dmp

Download

memory/756-12-0x0000000000400000-0x0000000001D32000-memory.dmp

Download

memory/756-46-0x0000000000400000-0x0000000001D32000-memory.dmp

Download

memory/756-5-0x0000000002150000-0x00000000021B6000-memory.dmp

Download

memory/844-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/844-66-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/844-72-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/844-311-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/876-339-0x000001C9801E0000-0x000001C9802E0000-memory.dmp

Download

memory/876-385-0x000001C9942F0000-0x000001C994310000-memory.dmp

Download

memory/876-353-0x000001C993EF0000-0x000001C993FF0000-memory.dmp

Download

memory/876-366-0x000001C983C10000-0x000001C983C30000-memory.dmp

Download

memory/876-352-0x000001C983AB0000-0x000001C983AD0000-memory.dmp

Download

memory/1720-317-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1720-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1720-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1720-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2088-50-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2088-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2088-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2548-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2548-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2548-527-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2548-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2548-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2548-529-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3076-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3076-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3076-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3076-314-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3076-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3852-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3852-154-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3852-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3852-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4256-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4256-131-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4256-139-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4256-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4256-137-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4376-49-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4376-42-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4376-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4376-36-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4812-78-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/4812-82-0x0000000000850000-0x00000000008B6000-memory.dmp

Download

memory/4812-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4812-312-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4908-297-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4908-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4908-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/4908-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5264-508-0x000000000E8C0000-0x000000000F13B000-memory.dmp

Download

memory/5876-51-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5876-21-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/5876-15-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download