d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f

Analysis

max time kernel
112s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
Size 3.7MB
Sample260708-pflylagt7k
SHA256 d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f
MD5 4b867fa5e7be86b3ef04415ee8395b0b
SHA1 49d63f855e2426cca0ed8be6d5bd5ac7f0f63494
SHA512 31ab94ead2de75a839e576538784a7cd428676bd56f0a3b49e819160ad43fc7ba16b831677f5b8b5dfbe0b34d90a225d999add04cd94ac763c2ec603cfbdee5d
SSDEEP 49152:yKABc3HsllZqMFTbT296BT5bVMvdTsP5N/obui2GBE2pIzTGHniK3HQAQgAT76s+:+Bc3Hs0+bWsPXobuYB+zqJqGsQr
TLSH
T1DB06B003EF81C071E592163E82BAABBA8E7DAD105325D6C3D6943C148D775D2E63A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
416	elevation_service.exe
4520	elevation_service.exe
2656	maintenanceservice.exe
3972	OSE.EXE
4448	PerceptionSimulationService.exe
708	perfhost.exe
3288	ReFsDedupSvc.exe
1500	SensorDataService.exe
3964	ssh-agent.exe
3424	AgentService.exe
3092	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\locator.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\948f524d2718719d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\vssvc.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\System32\vds.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114953\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\SwitchMove.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008945aba3d30edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000923fc4a2d30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd0a42a3d30edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a3a4b1a3d30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004314eda2d30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eeb1a9a2d30edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{5DACBE92-3134-4AD3-9334-338D66E126FF}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{FCCBEB5C-F6B6-49B6-A6F9-7862C790FE24}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
416	elevation_service.exe
416	elevation_service.exe
416	elevation_service.exe
416	elevation_service.exe
416	elevation_service.exe
416	elevation_service.exe
416	elevation_service.exe
2008	explorer.exe
2008	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3288	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3288	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3424	AgentService.exe
Token: 33	3092	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3092	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3092	SearchIndexer.exe
Token: SeDebugPrivilege	4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
Token: SeDebugPrivilege	4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
Token: SeDebugPrivilege	4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
Token: SeDebugPrivilege	4880	d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
Token: SeDebugPrivilege	416	elevation_service.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe
Token: SeShutdownPrivilege	2008	explorer.exe
Token: SeCreatePagefilePrivilege	2008	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2864	sihost.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe
2008	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3900	StartMenuExperienceHost.exe
2960	SearchHost.exe
2008	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 756	3092	SearchIndexer.exe	99
PID 3092 wrote to memory of 5036	3092	SearchIndexer.exe	100
PID 3092 wrote to memory of 4960	3092	SearchIndexer.exe	101
PID 3092 wrote to memory of 3540	3092	SearchIndexer.exe	102
PID 2864 wrote to memory of 2008	2864	sihost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe
"C:\Users\Admin\AppData\Local\Temp\d3148bdd12f1af0d4472229abbe7ef4ee3db21fcb9933ac4c1e8a8d50275c92f.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4520

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3972

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4448

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:708

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3288

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2786392678-1011493168-3329660577-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5036
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3540
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4636

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2008

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2960

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 151dc3c6c9cb387e5595a803c540ca3ccc9cfc2c77e2ee6f62653dbc9e7f6eb2
MD5 ccbe6473ed104bc9baa834e0814fa4a7
SHA1 f30ef2a77cca3a01678432ddd6839d5340fc1047
SHA512 7de74f5c1e7eab0b5686b41b59dccd102ea4c174045633a6765b5e23d55f95d0e3780d9ebd9c16687fda1bc209447a736159bceeec08b465df095cd6cd5d9151
SSDEEP 49152:0b+632BuPkFKRrdE6ohvstBhuXjfS4LWxniAQgAT76sQuE:u3q6sjBQqGsQr
TLSH
T11ED59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 917dab7c6ef8320bf18dcea6ae5ce04925ff6703d2ddcdbbff9ddfce3339190d
MD5 d045a0df288da4190575396ea3efda59
SHA1 7f3e041439d571af42abdfa793c470336aa579e9
SHA512 a4d5b2af5c81005d73646b357c9ebc44bec9421767b9493cdff3ea25d98b3fbfef249b43c25ebb65d8d3ad33159c41d9a3d087cba1e64379b426dd274f3cbc71
SSDEEP 24576:BXYfDtczA3AfYLH8AcevDN0FImbwQuq3Wia7gD:EtcwAQgAT76sQuE
TLSH
T1BE75F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8873c8fbeea3825a24a186b9f7a3355616e7ffd904507df403b3f946375c79c4
MD5 cfba4a2e833ce40bc1c5647260228eed
SHA1 912f20e62f6e9ba07f737ff4fb8430384d7e03fb
SHA512 8592b4e059310a484aa6ee1c213fac2e27c57e7d6f6dc9f544effc6042d8648555f25a04fe67514545142ed839afe8d614779dc6cb39fc440502a02cb8f27ce7
SSDEEP 24576:H0Le5ji0hmxxrM6AfYLH8AcevDN0FImbwQuq3Wia7gD:HPji0AjxAQgAT76sQuE
TLSH
T16785AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3f167ba2c84e05100e53ac6aa9a861b237f66bf9dd3b26832d70986c5ccd2cd8
MD5 79080b2cfa1d3635b83b34c71809ec41
SHA1 7ec1ec2264280efa8321c61be77aefaf02bbc771
SHA512 c2837d8e874e782a8b219b668f477ffe75822db4e89350f98d2257e7d3bbdda014b2d6ff8a65491496a316123ca7180771812cb15c24c23c14b6afcbe57c0749
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuAAfYLH8AcevDN0FImbwQuq3Wia7gD:+/ezSC6vUzPveHjyNAQgAT76sQuE
TLSH
T13D755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d919fd2a049a9d6c2c74b8b8ba064ab855eda7ca4781722982ec1127fb20bbf5
MD5 c5a124058b6b30d4acbc076b80086a0d
SHA1 f893e7ba4d484c03a2969b398ad726208888910a
SHA512 b18f3a20a5449c132df83238eee87cb9fe54714b7a0355b7ab72150bb5b9ce570757106eba1f1e7118ff06c7c63e64ec09e1aca09938f5348183625395d4a8b4
SSDEEP 24576:MVbqPb88hv/l+YbAfYLH8AcevDN0FImbwQuq3Wia7gD:MVO88hXl+oAQgAT76sQuE
TLSH
T1CD559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E676E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9efc090b8eb28bab7f2f302ded0c6a6b02b4d8366b6a1208ca991cb494fc83b6
MD5 c1338a83aac88eda9bf47cfc372b8c4a
SHA1 29f913c78d2efc8b7771e4dfa72074695c6f4afe
SHA512 7a2e3c91621484df5d0d793daa12a4d806e4aa9c4286aa1cae286977b6f1b310dd43bb886d9c4a0960bfd4f3b9a69bfa87527fbc0c2d3bc916a5b9aa507a9c6f
SSDEEP 12288:2LOAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2LOAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B3552357864C30EAFEFBD1369CBBA5B963D1BCB88285979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 de5292eadfa2bf7754fd2f6cf4409ed82dd108e69150a49f320781340022d22d
MD5 3f15268d17acb317eb42e8da99530ada
SHA1 075f93c06a4baf3fc0abce06551f441819ad6030
SHA512 3431a056244b9ff3df5b3070e15b27b1bec2dcd7b86675b6e1807e9085e9796164359542b9e3e8c93e01f82bce685846419bfc0bde0d5b8a1cc9ade43c239ba6
SSDEEP 24576:yJIUTAfYLH8AcevDN0FImbwQuq3Wia7gD:yJIUTAQgAT76sQuE
TLSH
T17675DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4af9a59f0270614cb9dc042bc6306226b371e48a8a05fe9d7894456f63d1c97a
MD5 6b73790664cec6e871b2b3358e211760
SHA1 0e5a25e5bc1aef119de86679ec487f1115c77d61
SHA512 a0a58726039cde8ad4ac7bfe49d3131d00a95ddb3ba85a5f3d2bf80a64b81561ae19f77c6254bb3d050529a4b4717854a7a36150ab6c98eedeefe84a313f4411
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:2QvGAdlCEL8c/DRNw5CFqGsQr
TLSH
T1C2266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fe25ad9ec256f1255fa2add97e38de3f004a976d1bd583c5d5495ca7f85f83d2
MD5 54e785e7a0769e9432b3a252297959bd
SHA1 9aec01e5c5ecc043a8b431ac6249a8d8d3c9546c
SHA512 fd90cf29afa38da0216e340504728b10cab3b0d4e4be0af818352345ebda16cd1b8b38b799ae8a1780e93596e3885f3cc4d7b21944ae2b92e8f3e4312a669f92
SSDEEP 24576:G0ewsAjBAfYLH8AcevDN0FImbwQuq3Wia7gD:XljBAQgAT76sQuE
TLSH
T14475E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e770b12806868e404f903c76e49549a3fa26d6c83cad3e56ec9dd9820a7717d
MD5 32f7eff26c1138d103d9d22521871bdc
SHA1 13ab3a90691d6ece8424c56c8dee387c8da7832b
SHA512 de1c31b63b5ea6926ffa41fb4dddf420f0796f8a32d5178b58e14a687e5d328b9ac5c6631f15e3e4a59c86643720294c26b1dfbca53861f65f8255afe9979f43
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHUj:xUEtQevvqc2W1cpV2tI32
TLSH
T157474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2bfb5d1746d751d7f79f6b4d6ae3da1fe887975373dee19a19d988e35cfd094d
MD5 0097351295d79cd15a54b6f41057583d
SHA1 503efd086842db83d97ea392841c3e7dbcd70a0f
SHA512 ffe14538afdeec7a18d18fa145eeb00f08429bfc0ece9185603d00fdbac305e690006e24dd72f8cf121725d37c2d116d659e927aa54f9c0610f7f3c91d67f4da
SSDEEP 49152:gCbRquA/m2yL5zTfFiV+XenmE3/zhAQgAT76sQuE:poquVjnmxqGsQr
TLSH
T119D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5d97b79b5e0c74b4d2ed44544533390b745e7ce25fcf51a94572f890ea9deaaa
MD5 82c41e38efed3113a4b458b2f8524141
SHA1 c684ef2a4e379912f9db29627fec020627ae433c
SHA512 c4106428328a4697f06fdffcb43109c12499a822698738cc08d7f9e268006f0ef23077ce7b0c70083844732695c372b1393e9e7f1d2a52492c148297e857ca72
SSDEEP 24576:vAhGL3IFoiwtA5l7S53sAfYLH8AcevDN0FImbwQuq3Wia7gD:vAMUFoiq5cAQgAT76sQuE
TLSH
T16F359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f81af83c9626fb789b543560f14035fe00da4116b49ee5445d613e3f12754a5c
MD5 6b91bb0fc1a882f2cc1540d69dca681f
SHA1 18d45a10ada4dd73198a55b88a154819a12f5f23
SHA512 8441a9a1fa7d2448e35398f59f2e00ba1671788eea38c6c5435f343a6c35e17630882a58d922d414e3f7cb0f24907dad480fde94828496ed1ee4af1f96f98ea0
SSDEEP 24576:/wu4OWtAfYLH8AcevDN0FImbwQuq3Wia7gD:/wvOYAQgAT76sQuE
TLSH
T15065F14676A81CF9E9A7813985A7C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 30289bfdbd06f7f655296b9f79dbe2da11029e67692290bca995dbcb3975c843
MD5 6680dcdbd86601a0a8c2ecb2a69e4c46
SHA1 a8a0068be39f7cf20d09f4ba5088d9586d06b6d9
SHA512 d881805454299c963eeaefcbbdabb1a0d51c2684b632b553f2ebeb00e7324135e750ad8fc441f1457e8325d1e0a0462ffa1983f91910eab7ca1c242f58c85f68
SSDEEP 24576:mZuyAfYLH8AcevDN0FImbwQuq3Wia7gD:uAQgAT76sQuE
TLSH
T1AF55129B239830FAE5A7C139CCF65659E3B278A6532183CF0115079A2F37AC59D78B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 82150dda14f610aea1dafcba00c78850f8da5dedf5899960ad2760e87653c017
MD5 30e808bbe183ddf92a9cdf1757c26998
SHA1 ef65cb8e627166a6d50c3e5f64ef5d3c17c83392
SHA512 6d4e898a6345c9140303d42704498395e79c3946172c9055d79a1e1e811376d83bca281d226a462c1c8617bcbd7e0b3c18320392439523a71c714e61fdd275b1
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UU:6QRQyi36YOcPbLvw2gAf+PN3UqGsQr
TLSH
T135667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6cd598bf207ba130614e8c4c4019ad4000bb93e31112201f76728f8cb759b7b9
MD5 082a9707b8f00a0e3330db7b447f7c9a
SHA1 af829ff8f988d4606f5ca563de548bd7942b4be1
SHA512 c4e298480a209b8a448e9309ed831298aacaa523107784ed439e519e0f718c4626f82fcaaee9f66a0113b1d5a0b0e3f6cc616ed57592f156391f85e5a15b8694
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UU:8QRQyi36YOcPbLvw2gAf+PN3UqGsQr
TLSH
T129667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e38db935c02b52e6dfcf5929e5d06c6353a8203c8b2c74b4052a890d2349db7
MD5 b250229b2270632350ba6222374fd182
SHA1 75852dbe5cbd227521ad6012c21095d461b7609e
SHA512 53fb3ee597e2a3a21c7839dfdfefc8bd6b5dcd128a8cb336b2eb284ae02fbf18bf65a37f2d954cbe57975ebd18bf53db3767088971f56366cfd6bcae8c8c52e6
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0iAfYLH8AcevDN0Z:/68Qg55nhceWu7PNU3/xAQgAT76sQuE
TLSH
T196B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c135552f365295ccd90c9849c827bc6b4fb39548b2e9d1e0f2ff78de7427986d
MD5 4f52cdd8cd0491a9cf6a6fdcaa9775ca
SHA1 6a1ec9d27cda29ca241e78b82f92d01242434c5b
SHA512 c19fffdb5ef0165b777560cd6432052aa19f358b58107e06a601608039896e1ab6dc875c7d27cc41eaf2171bece5ce5a143d03ce55b36fa03f496b7348fe9569
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99i:Qy5112gYy5azzVvt69nLKnhZnqGsQr
TLSH
T11D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf1cdbde64185987b5aa70d820a3d34efc0a951747032d60bb2fe1b8d7374edb
MD5 b692566c9f26c95124d6b9f1ddeff02f
SHA1 87a575a60472a01901bc0205ec1ef62934e1a826
SHA512 1435cae3f01bf49a73a22102e0d43bbec18aebcbff1be640af0138e5aed93cde477269b032d35c6dd0a14b3427856687bba2781e4f88a59714da6dfaa4d6ebd7
SSDEEP 49152:MB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnAQgAT76sQuE:Gu6Jmdxd2dsqGsQr
TLSH
T153D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 224e86f3e03013d88cf917130400e689d3035419b96c895a4045ce24a72fce4f
MD5 edb5cefad585bb27bdce47545406a727
SHA1 d700b078bf0a23f283ba8fac5953c8926d60345c
SHA512 915a9b762064bc846120167de02f107b7e32f0bf6f32fc3eb90d678840c621a30f638863fcbb5b525c40d9e0bf946588a88235b6a012aa0d8472eac413493a07
SSDEEP 49152:j1hpsNoJpF1A63U44CwH7R4xzAQgAT76sQuE:jmifPWRxqGsQr
TLSH
T193B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a5eddf9d4fafa316b7cb09c12d752653236d3bf5edec865e52729d2e15340fb5
MD5 836c6b40ce80b7eb9d6c841a1651b2e0
SHA1 d1cbd0bea65ee34f5112f3979e760197fb83158f
SHA512 20d32c88bcd826a980282bd580d7fabb87df5ebc87263746bce4c9b1626ae8e5dcd072cf21a5e22cdc3ee9bedb280d9c11b37e84b08f0958b77716e33fcf300b
SSDEEP 49152:kSuZQIY0Be2KcRVtOnks6NMHqyAQgAT76sQuE:25dKii61rqGsQr
TLSH
T1A0C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 05e69a2a86beccee700dd03934de20ff4139614005e7ae75859a1a48d80739a0
MD5 2f5d57d6db945ad78d9ada55cf7de9f4
SHA1 32e45252953060a3aa22e651d01e71d1dff2c71e
SHA512 a3f71b2291c95c26a488c2277655dcd11e76b58597d20af721beeb2dcc41dab18673eb73d69c0d4ca9d0dbf623e5f5350b75d6e768fe6ab8edc9352a45540111
SSDEEP 49152:whtSn8EApI0fig3giDn0AP5w3AQgAT76sQuE:hX2imphNqGsQr
TLSH
T1EC95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8c19667e82b5c0444e4c3b9a279914aff270c661bf450b7774c83e8b6cdccbbf
MD5 0fa04d50c41806261c02baa8345ab134
SHA1 92d1c1f2c67a755a015e758b52de78fa8757fb19
SHA512 dd328af7c7375f388357990e20293a47b11b8f1cdbc5ed8573c884660e3c7a8868f939ef5d8b71de30aa69e6ec2e6052f27f4b21e9930847add0b1b67e08c0a3
SSDEEP 12288:NmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15755235B594C70EFFCBAD1368CB7A1B8A3C47CBDD346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0b4c2151708083a8dbd2f5f7b8a8b27ec710ccbfb14111fd29fdcd47d98f4b86
MD5 7bbdda6ab2a2d29dcbac05f550efcc6e
SHA1 afb9521e42e80abb5231e0379ae49ecb515b504c
SHA512 6b96c5d21a65fa31eefc78084cc28a82e891e4594812932f062466b27f938bd679c3bc0577d25743fafb8ef9a60b0845cd5c2e6437f1f7d5a1319ed58747cf95
SSDEEP 12288:71AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:71AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17255235B594C24EFFCBAD1368CB791F8A3C07CBE9346939A110E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3584e961368ffba973c53389cacb14b88159ddc4635f07d4b3ea8829a3f26ff9
MD5 0ed635a7ad9478cb3a8a14dd3cfc2392
SHA1 6f74abe598faaae8b2b287b6cd36e03f6ebad233
SHA512 08f02014b8f90664ebb03a78891c1cb4e3ca1a7c807ffadcee30487c181f3553ff8db97d0402301d541b7e5b23e836dfb1d7be2dfc10b2ecd5770ce7029c5cea
SSDEEP 12288:JLAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JLAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DD55235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1455a9ae82bd84042a5d22aa93f9691a00a8d5f9d0dd8e488f50ffb5a0405738
MD5 2a4618315caba272267048682f6b3ea3
SHA1 4d9ac19783601c51258af8cd76a010f4aae11621
SHA512 2c1bf35ff20534dd0b0d5bdbce5c202b90ca97c8c733fe3c1d87de34bd5d15ac798167d13652b63eb07b9360610c068de38cf9fb3919e63b316940ab67e27919
SSDEEP 12288:+VMAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1B2552357165C20DAFCBBD135CCB791B9E3E1BCB9931293DF46011A8A2E3A24891F4E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 18d890ce356da85e9e78e50e660de7b12e355eeb94f97f4706d5fe6adbbc2a7e
MD5 5c0b0faf23ca2106dc530e15d46c5a12
SHA1 7726edf1241ffd72285cf09fbd2be22cd7418bca
SHA512 9483830c685649f5780353fba7d706dde09a4727a0a80b52954349e64ad15c5f60e75b5d91a62657986bb507e40af6b8e3e20c7fe7d7bdf5dbd91676162506d0
SSDEEP 12288:60AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:60AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AB55235B594C30EFFCAAD1368CB751F8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d414de443a4c80f6386e0d096e975c2f47c385c8fc48fd43f40a618d9c2a3eb1
MD5 316ae2ed51151d19fae3b58da01a9d3e
SHA1 c5c2837551d661de6fb08fa5370a8a30a921ea84
SHA512 0bd3eae8b1efe925f8051988bcf5e9390396eae28e63e76813ec9c44e114c4411be2259fde7abd479169b97b1dd663c9c0514dd9816dae2adae3bde931bd981b
SSDEEP 12288:QZAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QZAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17C55235B594C20EFFCBAD1368CB791F8A3C07CBE9346939A150E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 01917b42afee38c0a34241ea2dbd226763d5b304557f0fb2cbdad7f2ba8bff38
MD5 ee842a24de9f62009204476a93951f3b
SHA1 d547c8fbfef455d14e359ed1456edd50e10fac2c
SHA512 5efc8340fc8a85cc6a25975fd873ef2d53bb1f79ea1b84dfd37d7825e01c6bc70836adabb1f38b68b74f5cd7bfbf13bbe8ac1b8ab6c316cb0879c05cfa59f9c5
SSDEEP 12288:ldAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ldAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12655235B994C24EFFCBAC1368CB791B893C07CBED346939A150E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 75b4d06f0a02a38325b2919f764ce70bf6bfc2c4d4865a829d87c6ec97974457
MD5 edd1c6329bb98b75133d509df54e1874
SHA1 14f4137eee404f77e27035b7fba8ce0ce179e52a
SHA512 d5c026445cfc1ea35770240492a9eebed043b24ba35bde8ec5eda4ec3a66593a4f001a9811c8361893cdd00819d48563f20c43622c538bbcc031b8cb7b39c88d
SSDEEP 24576:2ZMRzFVSOVAfYLH8AcevDN0FImbwQuq3Wia7gD:2ZMRzfpAQgAT76sQuE
TLSH
T107750195B39018F8EC67813ECC668916D2B27C6A0760C65F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7eba08602a44aad9c31eb54775deee58db299bd7702c1d0c4cfbb954ba3d75b3
MD5 8b0bf76e44d8f8d5587b3d37f7b56a6a
SHA1 6b7e420ec770eef86110f4e3d6a43ab2812d66e1
SHA512 09988c7346f2b77102df67612c250dbb077e366181e601c5fba562ed1c0cea3e070317dfa1f13c128720e3ec6f9a3d483a0f467c8c0d7e85296b85a9239fdffd
SSDEEP 12288:BCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12455235B594C34EFFCBAC1368CB791B893C47CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9c6e2edd5bc87283ad2380604b03dff2962f36e62355bb42ac751707060c11ae
MD5 95c6daa38839ce194a37dfc439a4dd8a
SHA1 4321021da33faa8d11aaba3aff41a4b0ff7d5fef
SHA512 728abf62c6e1f632ade8a192dd20f4be4efe0e496e94c7ae00be29985487d2f5dd6670dd14ce267b9a6698641b6fbe26c89ac56f8c817266d0b21d14d2ad42e9
SSDEEP 12288:0eAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:0eAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13F55235B594C24EFFCBAC1368DB791F893C07CBE9346939A150E2A867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5536252ca2d54a7e6f6768d6e11e9dfc7c3d6fbdd507058b33079e504f663b53
MD5 85a4d47eb0f21cd9a27af9b3bf4a0b9f
SHA1 654776874aee2fb6fad80a6046f6bb8c54e51251
SHA512 4419a4f92a9aa0876d9a508c260a0ee8920cd8a8307fe94d9c710234a6b4f2780ff993ca4195e4f05300b419c349cc973967c455aaa61feb358e689f8f94069f
SSDEEP 24576:dzyRAfYLH8AcevDN0FImbwQuq3Wia7gD:d4AQgAT76sQuE
TLSH
T1B465024763A530F9E577C239C8A21A55F3B1B87647108BAF135407B62E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 70ab8622c157c9af70ae57cc49e120e32593ce04ac2cf19698e0f086aea7f2ca
MD5 214ce0882955ecc1f910e5c69d5c3239
SHA1 f812d73a507984167aebd2e4dd51b59d732f517b
SHA512 fe3381cb0a8ca840496279de251f0c18e67a097bf3054b8b47aced8dbf35d56582fc7b1c68cf7b3d2f87790929a3658e9955cfc6e0f083f7c4e0a499dbbaf711
SSDEEP 12288:gCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:gCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17355235B594C34EFFCBAC1368CB791F893C47CBE9346939A150E2A8A7A3E40891D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 de973eeb9c0617802237574be803a62f21b8de78c4080fe527a451e4a2ebacc7
MD5 6c1844a9310e8da7f2df8d059d1f271f
SHA1 ce9a185ed6e91f0ab1b0de34480fde7a8d1c5f62
SHA512 a3b3cc829b1526c999fde94dde622a3084c1716e4a65e1403c52643e105ac0f5c01646d6ac9acb8dc8df0411777dae1e43ae53db131fc0db05ebfbf24c76f268
SSDEEP 12288:ZCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ZCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13455235B594C30EFFCBAC1368CB791B8A3C47CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 0ff419f37087899209e9b786e2db6c5d47e4037090387b3a791ce8cf17771040
MD5 8d56b6686977234c49cd6f2b364a4ade
SHA1 de6e6b8491017a25e47e2414bf1c2a4383a5c32a
SHA512 3daabc3d0c6c66b6a3285a18243aa80480622dfa41b6101209e45e3b055bbf797cc034f76d802861de8dbf52a717ce34940e35743ca6a3a414149a633f36db8a
SSDEEP 24576:izyRAfYLH8AcevDN0FImbwQuq3Wia7gD:i4AQgAT76sQuE
TLSH
T1D365024763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b6c7140f5d8f4ebeb1209928eba6375f37ef7c38d7957e863dca82c7db7cf68f
MD5 9bebc19a1143a2b692a2bb0ba26fa368
SHA1 2feb048b71c9c9212ba143551a0292fb66894623
SHA512 a3c8fcb8482d987476152b62e032470768a8c12be2b82c9e002808b444c0044d9df912c27cbe2274b11be2f9b56aab95b48cc1234ac788c064e8ab9018314e27
SSDEEP 24576:CTDaLl3z0zD7AfYLH8AcevDN0FImbwQuq3Wia7gD:CTuLljAAQgAT76sQuE
TLSH
T1437501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9e59f64ae868ff2d64c166a13e04ebdc56a4b9e4bb600fda1c2cc2d1bbf53d12
MD5 f393ee4500b0f3da916f23309c8132a4
SHA1 46501ab061347f2732f1ffe954b6161cb6701e12
SHA512 31016fafca27189bfbec9acb944052a5ac3f4b97fa82fd2935818a77b59d9edd8c9132a3d6929a5a899891c1bf5e3c68b0cf5e78adc8c014116dfa653d3fbc80
SSDEEP 24576:L3vd9CHKy7GZPAfYLH8AcevDN0FImbwQuq3Wia7gD:rvd9CHKyapAQgAT76sQuE
TLSH
T1F185CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 16366cb378b8980718a060baaf1418b729e2adf4eb5e96dfae9e6d60f4557d10
MD5 7366733f35bdf3d474b0d5bc1fec0413
SHA1 04318c287c83ba2a322e758dee64c4cd5b391401
SHA512 2bce489d351efff89171c9fc7bd2e3044c3e14e7da9fb143623b5722349f47dbe75db0bb6a38ee7f0baa0896313ca4a145b01711ab6afaec0b7703d84623f4fd
SSDEEP 12288:CrAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:CrAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F855235B994C30EFFCAAD1368C7791F8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2b8972dcac927e420022b9fb2bb1cb2eb5830385db56b3bcf312d873a96d3c79
MD5 fc105888aab0769de372037dd6d66596
SHA1 77828444a89e92d9a3c17fd0b43e7f3f132a73fb
SHA512 ef7af00b288f9f56eabc6b91da9e937d41ded7e33078fd2e9360400f9539354583aaf2ab452986869e807000945b5b485893a1cd5e9a37d825df693dfb88df06
SSDEEP 12288:SxAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:SxAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E055235B594C34EFFCBAC1368CB795B8A3C07CBDD346939A150A2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5d329ac8c36509178af454575a9b114225e179947355c883707bcd4c647e2f5c
MD5 3135fd13f100b9aacd45ce6f16c54032
SHA1 30f9ad96d1ce2cc223ab02b414bf3a82bdd20543
SHA512 9967d73e31cbb55795eded089999345f2363cf8cd69938e9265563811e34b4daf1672ddeeaddd22d5c13d8ae2e2c2944b99b98d6fb9f025270ef8228c263cc89
SSDEEP 12288:mIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mIAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15455235B594C34EFFCBAC1368DB791F8A3D07CBE9346939A150A2A897A3E408D1D4C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ab62d29ff3cec62d96a5270b769b1b89ad79e05144c7f45620ec98aec9bb49ee
MD5 9956fa034b2c89d752f9c8df4a501d60
SHA1 ec93121114989b64d0c311c4d0db145905e70cc4
SHA512 5dac7bbccca01ba23b37f40a2c1cc096853de31e34f57d2139b72874e9ccd32bdfddc2860fc344aab8f811f865d68c1932fea3ec99ea65e4cb1ca09b0d575c9c
SSDEEP 12288:ICAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ICAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T12E55235B594C34EFFCBAC1368CB795B893C07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 243bd8d2d8709b9b16f18768d93a1ae7932fabd23f51d6d8c1a9b19b8c06518a
MD5 3e5b4ffea07d9f1f718998255589fcaf
SHA1 75a71e769a0eedba0d0924d3a736ac11e5cc2ed6
SHA512 97bc0211929f8800fd9ad640f834ac7c717680040deaa20004a462c268358570d5226f7cd63db217fd401a372b2f2f330d2180b0ff7c88a88aa055e9fa82ef95
SSDEEP 12288:RrAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RrAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17855235B594C30EFFCAAC1368CB791F8A3D07CBE9346939A150E268A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 06bf1290189315c1753298713ba80aa04f9bea1151dcbf7441c5f10fecf6cc20
MD5 20c9ac727bda4cd2fb38edbbc231079d
SHA1 2ea5ce8c553751f261e962e595f9d991c0144214
SHA512 8bad1979d07e157f84731608549f141ed3626e1c37d5c9be6c3276f678aa04a5f3227ebebd8c7e5b7cac63cf3d73cde49bbc0c3c7bf08214053d66267ccf0845
SSDEEP 12288:LqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LqAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C555235B594C24EFFCBAC1368DB795B893C47CBE9346939A150A2B8A7A3E408D1D4C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 0f08a12ca748f08f2b0be0b133fbfafaf783f6a14775e5347074470bfca8254a
MD5 7ad7a7e98ad88d29fe71822a1b523412
SHA1 02812a49efe8ac9252d2de468faebe1cb329ac8d
SHA512 409d2576b18b6d2c088cf392d89416371f3ed0f682d61f7376fcbacb379f1f7b7fae742f714072dc6a3c2b3355f41aa3291ca08133b7971f3b634d3b5cd1ebd2
SSDEEP 12288:70AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:70AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15755235B594C30EFFCAAC1368CB791F8A3D07CBE9346939A150E2A867A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 7bf2ca579e9317f0f626f9e472d3b30d09089bd5cb115a8bb244304925d19e91
MD5 83a7d6794bef45b4dc374f3e2d665435
SHA1 a703a1d67cb62fcf5ceb724308f1cb28b2058911
SHA512 d0dccf610cd95f625791f97dc2c69be9fc6f4fbcb894ea7ccf13addeea2ccfac7178de535ea6e91487e39e895e7a29ce4a174771411989e0b3a359571ecd036c
SSDEEP 12288:RjAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RjAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19A55235B594C24EFFCBAC1368DB795B893C47CBDD386939A150A2B8A7A3E408D1D4C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 2df36f43485bc9c97606112e72aa7f6df160754ba90e460f0622fd739838515b
MD5 28ee010b1c81e9dc3bfe12f811c7d4ce
SHA1 656af7ee8164c937e7b1765c6c8c5e889841870d
SHA512 86cfb7860cc0019363cf7bc7c657e1ce3f990e3e52271bcbebb643d3d6ee5056d2fad516ae9b419664f15d25c7070be197c8b25ffb5f7b679a5c0ebb06ddd183
SSDEEP 24576:VfwvUk9RX6wkyAIuAfYLH8AcevDN0FImbwQuq3Wia7gD:nMnYIuAQgAT76sQuE
TLSH
T1C285CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e877fb4f68bd49a36086fa4f307450acdf5233ecf1c9b444c22671c381918c81
MD5 ce500c5c6fa951f36fa048ade774b041
SHA1 35f930ad655719be97500e5389bcffc3c4d4aad2
SHA512 ad3085fa9489514492c7240942efc8a80a5b7e261dd8f0f7acabf50469b72b7a300b3508ab65c9b66e140755644cae501ecf9406462ab3a6630e3b8f5b4091b7
SSDEEP 49152:qYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XAQgAT76sQuE:RySzP0qGsQr
TLSH
T163066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 96d6ba4bb09ccb49edf1751f39e58831972029b1cfb6b74cbbd5ab05b30a4d1a
MD5 d3b5558d980b6094eefddde7b83a1099
SHA1 b59478e18c763015f8549b7f6d44046971c71159
SHA512 c320c128956181a3f13775040022c49b46a6f6631c12228d034abde8a21d92628b0ebc13e1d7b11ec23c75fc35e267f0909b9e9885c2d1a57b5b29dca48b9a0e
SSDEEP 24576:t47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYlAfYLH8AcevDN0FImbwQuq3Wia7gD:t47JUQjTirIhCnDHUPfF/nAQgAT76sQr
TLSH
T149659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 37182efcc82d8bde89dfc354bfce14d06bbd859ccc719dc23e15d68eb802b7a9
MD5 fb1b90b8370596364c2c5ec3f084057f
SHA1 e75cf4b561c80a3cfbe84b16807ac8ef053e8208
SHA512 039b58c82e1a0baf30784375b775873566517d0f1fdf7b22ed3112f82ca9305950d4a9b7e60b949f53e706a3dff19561894640e6af4d42bf04be51352c27ad2e
SSDEEP 12288:6bsfyAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RyAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DD65011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e9b6230f75306739996939c9f0c1ac2af7a196fc17b8b9c0e6f7ec5aca43664b
MD5 8d70472568ca1ed1d2d726e52f412518
SHA1 5c1d1bccb68e48fb7d2811d2c1b54fc020894867
SHA512 15f57a17e101578856c00f42841717343323b8b573f594057b5a30aab3616f3c43a8a2d301646391bbe6303e4603059a431f2e96fe3f52dce264cc8fb9db1398
SSDEEP 12288:J8gjHxxAFSCXN6j+W+P5O5Ib1cjiMj3XvKjWms4:J8oH+Fh91NMjXCjfs4
TLSH
T147451710766AC74FC6AD40325E37D1CCAB707D41EE45AF0772C88B3F9576658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ce3dbd8dedde89c764aba1c34fbcfd450a3d918afd8a8b3385e12c0b3414ff8b
MD5 5d42d65f938a7c9c1c4e22b4153080bd
SHA1 a38993cf18993b7da1a4737cea32d8f93d32ea9a
SHA512 c40774a083e9ac9e64f640f96a48db205e2c5eb54f7761ef6b0ce7e82348638811ae88303b0046a9a682e209c33c81338f62ccac86d60bb0ad544fac48862575
SSDEEP 6144:o6aDoayMwgagPizkgln1QIAFSCXN6xx8b8v8O8xtMxUKutMxUKe28QjN6oPBm:bAakgNAFSCXN6xx8b8v8O808y0
TLSH
T18765D8406537A38FC6BA5072072A9F4C77A4EC07B7499F2673C8443AD86AB15A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 76051c7134ef5b2b172ae67cc7317ea11daedcc3d11f55c52922e505f501568b
MD5 c4e03b2110e8235d6398eba4c822e6d7
SHA1 679b959d6b0facd129ac0638cb30447d1f74be83
SHA512 7a37b1dae67bc4c67c04175903beffeadc45668a301ba22c70f94c0050de9c87f65d5d8a31c80a8109a231fe28f8886da919b6c1555645507e14a693ca20f08b
TLSH
T18EF0D44BD3A16766E427133C859615D17531E9506F43113340509F5C3D27B219E034FC
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 5d5c80873b47e24c4d6fc935e88e6b7d7d466df3fdfa98414950420394d37a35
MD5 f78afb2421b4714c35014cc60e83ffe8
SHA1 54b206f17f8e19741868c4c939b42f519f9e0378
SHA512 1ec0fadcd813ceb40bb25510a3ecb852eafc10042a0f6f55bba037e62dc300f7c338e01f3d972869be66289b2ccaeb74c403c3ef8b667c281200bfc112659f80
SSDEEP 12288:a07aAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:baAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T110552357874C64DAFCBAD135487B91386399BDBC8700D2DB640A27CA793D8C8D9F4E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 813567ef13e12f3c4329ea78c301e0ecd1e0a5edfd97dbab33ce25878d1a8959
MD5 6cb98b932da05a8879339b2950d34e40
SHA1 62f5a1fb55e59fc9aa43707655712f8cf01dadec
SHA512 7e2c10e90ca5f4b29b45d8a45cd954a5c029e8418b2be415bdc5b77e8d94019ed3a93da32cd26b6b7b65f4aa83540808676fb7ba632190565ae9d384a947044c
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYAAfYLH8AcevDN0FImbwQuq3Wia7gD:+gb4mBIBhGFlAQgAT76sQuE
TLSH
T11A65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 d261bda6e0091aa716de7c246d37a18981fcc308fd3b0aa4a68b2683ec49c58b
MD5 672aa152613a2cd5b50d06bbd7a45689
SHA1 775c26661174f844c33faa274723533ef229b115
SHA512 4063df9f4a9dfb597d8c27bf2e74619a5225543ac67f8b865ac797f90775e2ce931180ab674ccf65a1ec5af6b099fac47898fa6742dbfe7bd1e1dd55dce3f8c6
SSDEEP 24576:QG88u8FpJqH1bzria7/mVAfYLH8AcevDN0FImbwQuq3Wia7gD:D7ZFPqVea7/oAQgAT76sQuE
TLSH
T10185F16667E401F1D47BD13889924663F6B2B8250364EBDF06AC8B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6709474ef4a23e1ab69abe2d6f9adf2a1fe701faf50185c3b5408d9d15e3dbc8
MD5 9c3f7fc0722ebb837afc9c01b877374c
SHA1 7e0ffe2c635ba6eba0438ebd2a76d682735eaf1d
SHA512 2df4f994f85b110a5c78f534b256f62fd95ac6ab41e16e27bc02ed4b3d3f9de1bdae20b3b31f01f912af2ed3a122ca403a967c95e55aa6a5c403b2129be8706b
SSDEEP 24576:kPUr+NQpAfYLH8AcevDN0FImbwQuq3Wia7gD:kJQpAQgAT76sQuE
TLSH
T1F565E12F229C18E5E67AE13D89968619F771B8660312D2CF0291817E5F37DD8AD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fac219fa65d3f1c7eb7bc71a37b22f1eeb56eac109254dd90427fe206042c768
MD5 719bcb5be6f58e3544b7051ef8251dae
SHA1 09993b69b7d75dcb1bf725038fe97d8daa00d9b8
SHA512 041e890c9bdbcfac224b81f2a26b969fb6de6d4faccedd7b55d9d4ba8ad551051f861ad15f398969e3dba0d254c47f06736f1c101f37920a074067cbea097355
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZAQgAT76sQuE:/G05lO43bvqGsQr
TLSH
T110D5C06E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b130cfce5a8f3851fce419890a388a8c8bd44229c29ee89cceb369aa1e3d2ccd
MD5 df36b107e0d56100510664845ba4eeb7
SHA1 e382e634d40279417aaeafee9fa541b8dfe65c58
SHA512 19d689c08d77223f912e086ea77652ddea8debf8df43419cf338560680668fd05e39cc57b2ae7940abda875fa83cc593b0815665d598ab865080653fb122d450
SSDEEP 24576:lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXAfYLH8AcevDN0FImbwQuq3Wia7E:la5POZ3BJt2pasx2+mxAQgAT76sQuE
TLSH
T16865AF5EA6FC00D5E5B9D17DC583861AF5B1342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e3524b8f8c66f1d84e32e8db9e95b2f9fd1b7891ec0a31b9274d4473c523c45d
MD5 3aabaab524ce3e78f07dbf32d368d012
SHA1 c5f13689eac493e292c4c58a6acc56b40f30df95
SHA512 bf776c8afe19e28395e6b1bce0937153014d5070be213f80ac161b53544320633d3cce5a4af72ffcd0d89960afb1c364d513cb6dbb2e789cbafed82f7ee520d0
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkNAfYLH8AcevDN0FImbwQuq3Wia7gD:gNc/zEOVHFIAQgAT76sQuE
TLSH
T1A5857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 628c1101f24b801306ffc3e0fafed43573aab17552b9825031e4c7cfaaa3d3c8
MD5 d156964ba050a709a53b779b40cc0b70
SHA1 6d1e40996b1acf4a1aa20634633a7e94205cced2
SHA512 45054567e41bcd88bf2e4986bc6e740894e35eb9fa8dfc703c240a2affa505f8045f6f538d68b34ff0b02d06f83645d4076f9f40414772670c83b0fcce0be093
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmjAfYLH8AcevDN0FImbwQuq3Wia7gD:aTMwBtOmjAQgAT76sQuE
TLSH
T14555AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 312dd5c9d8266b177a5fd759bed90d6efc787cfb21ab0ebf5b79261712952bb6
MD5 48db05576287b78078f84a40fe695593
SHA1 71943cbcf42087d6f6c66baff2915ce43d10c5bb
SHA512 f36a8f7708cccc14d0844628e6324926bcd8ec8be95ebdfc9f82298fef146cc1ca99da6cd12e6142285c65221deb43bb8e550205f296c646ef4d7a51bab04354
SSDEEP 24576:FD3FHshBIYQgAGAfYLH8AcevDN0FImbwQuq3Wia7gD:FDVHeBIAAGAQgAT76sQuE
TLSH
T18D75E17EE65C04E4E57BD17CCA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/416-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/416-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/416-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/708-74-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/708-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1500-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1500-98-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1500-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1500-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1500-312-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2008-616-0x000000000F770000-0x000000000F7EC000-memory.dmp

Download

memory/2656-43-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/2656-36-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2656-37-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/2656-47-0x0000000002250000-0x00000000022B0000-memory.dmp

Download

memory/2656-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2960-458-0x00000273743B0000-0x00000273743D0000-memory.dmp

Download

memory/2960-459-0x00000273747F0000-0x00000273748F0000-memory.dmp

Download

memory/2960-496-0x0000027375090000-0x00000273750B0000-memory.dmp

Download

memory/2960-461-0x0000027374790000-0x00000273747B0000-memory.dmp

Download

memory/2960-453-0x0000026B6FAA0000-0x0000026B6FBA0000-memory.dmp

Download

memory/3092-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3092-135-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3092-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3092-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3288-78-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3288-85-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3288-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-84-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-427-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3288-425-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3424-124-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3424-116-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3424-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3424-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3424-122-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3540-327-0x00000233CA6C0000-0x00000233CA73C000-memory.dmp

Download

memory/3540-326-0x00000233CA2D0000-0x00000233CA518000-memory.dmp

Download

memory/3964-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3964-104-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3964-110-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3964-311-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3972-52-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3972-58-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3972-292-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3972-51-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4448-64-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4448-70-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4448-63-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4448-306-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4520-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4520-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4520-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4520-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4880-0-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/4880-374-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/4880-77-0x0000000000400000-0x00000000007BA000-memory.dmp

Download

memory/4880-8-0x00000000027D0000-0x0000000002836000-memory.dmp

Download

memory/4880-1-0x00000000027D0000-0x0000000002836000-memory.dmp

Download