8852450e6cbed4ea4f5ce7d44eda7ecbeb5e08fe38e240c25f9e267c1620317a

Analysis

max time kernel
82s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 1.6MB
Sample260709-mcaeaagv4k
SHA256 8852450e6cbed4ea4f5ce7d44eda7ecbeb5e08fe38e240c25f9e267c1620317a
MD5 b03f20c2a93d46079701ec07358bf958
SHA1 50ffdf0abc271e893becc45919bcfe41c9b7626a
SHA512 d1f236874eb3b4add83c5ccb8357465b1816c980bac4c4c377af1c68b530fc8dbf784414680169ba055dae73f49f4f627033ad0e5f8834f462807593fdbab508
SSDEEP 24576:LKLGkmFmiCsqjnhMgeiCl7G0nehbGZpbD:L7wDmg27RnWGj
TLSH
T17B75F155B39401F8E4778138CA965A07FAB2B4560720DBDB23ECDA751F23AE01E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2120	elevation_service.exe
2288	elevation_service.exe
2744	maintenanceservice.exe
1760	OSE.EXE
5124	PerceptionSimulationService.exe
1984	perfhost.exe
5616	ReFsDedupSvc.exe
2308	SensorDataService.exe
5004	ssh-agent.exe
5676	AgentService.exe
3692	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5d71d01dd8ede1e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aca6ec5c8c0fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{D11357AC-E146-4E80-933F-DF58B34CC1F7}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{B6BFDA3B-79A5-46BB-8AC0-4B892840E528}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1068	explorer.exe
1068	explorer.exe
2120	elevation_service.exe
2120	elevation_service.exe
2120	elevation_service.exe
2120	elevation_service.exe
2120	elevation_service.exe
2120	elevation_service.exe
2120	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1176	2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
Token: SeTakeOwnershipPrivilege	2120	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5676	AgentService.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5616	ReFsDedupSvc.exe
Token: 33	3692	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3692	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3692	SearchIndexer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeDebugPrivilege	2120	elevation_service.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe
Token: SeShutdownPrivilege	1068	explorer.exe
Token: SeCreatePagefilePrivilege	1068	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4020	sihost.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe
1068	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4708	StartMenuExperienceHost.exe
4104	SearchHost.exe
1068	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 5440	3692	SearchIndexer.exe	100
PID 3692 wrote to memory of 3416	3692	SearchIndexer.exe	101
PID 3692 wrote to memory of 3432	3692	SearchIndexer.exe	102
PID 3692 wrote to memory of 3404	3692	SearchIndexer.exe	103
PID 4020 wrote to memory of 1068	4020	sihost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_b03f20c2a93d46079701ec07358bf958_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2532687178-1633831978-1202193935-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2660

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1068

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4104

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7df3ba9fc0084796bd70a3d8e82798dd84ec23580caec07b45c2eb5bb2f4d905
MD5 c5d785fc4ff3f0e4bd833a21eb1df8b0
SHA1 43154295093168ca0d95d6cd129a6ea3ce6ad5cd
SHA512 10e30191022e8e74c7aab8d623165edb4a0fdb459d1fb5fc1e5d74926bbae41be4af3f7d284a81dd84d13bbc0bfdc6614bdd1d5afc16daf14355155399339469
SSDEEP 49152:cb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnODmg27RnWGj:G3q6tjBFD527BWG
TLSH
T181D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 468da2c9bff38b61e91f20e46476bb772ea9a3f25cf1a575af938a8f02ab8cd3
MD5 4919829cc99ab7f01b04d81439a8e683
SHA1 2e938ef8e57ec6471b5333c8d34618fb6f25d2e4
SHA512 ce2393cbc52ceaec73b905cab7153de4f667f2b6eb230e01657939de3a3341d6817beb9e1454b2db3072f5d219870595a72e403997410517a1d070211dd0056d
SSDEEP 24576:UXYfDtczAdsqjnhMgeiCl7G0nehbGZpbD:TtcoDmg27RnWGj
TLSH
T135650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 516e0468da6ec89232252e118064c7e4113567beb9f35f0f1c00343592a7e008
MD5 fb2d2c12abca884596590be86143ed1b
SHA1 e3dc9fa01657bbba9637db6b27d21d150f26be61
SHA512 fa6ea6d764f8c081f3ed2f94147d61d4187e7095413990214861212ca0aba7e86117d3b0640d03af40dd725ecd1a4623d4d06aa995f65d9c562439a332bbef38
SSDEEP 24576:E0Le5ji0hmxnrMLsqjnhMgeiCl7G0nehbGZpbD:EPji0Ax6Dmg27RnWGj
TLSH
T1E6859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1c1c6207aeb713bf7db5c3361ccfb6701be9497645690f2e80d116b84c238548
MD5 89d790a971aee39e6f568a8bef526045
SHA1 97ea94c94c544d4dc95e49074700ca5260b6642e
SHA512 a136007eb3e96a8363050d0f8917f4ec16309e179d1039b648e8cf924a64494f806b58c6afad47b022b9044007eba65b61fc1ba7bf3feedfd6a1d0d9b3b5e1b1
SSDEEP 24576:Ha7/ezSC6vUyDZaqgrvWx6q8wyuBsqjnhMgeiCl7G0nehbGZpbD:K/ezSC6vURPvMHjyuDmg27RnWGj
TLSH
T132755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b5f40d8958f01f479cadfbdd3443a48e25cb572eabf8001bc97747acc6be7f56
MD5 1121c1fd2922f181d1bc4f89476fda82
SHA1 54b600e66de1f572c4aedbcca4e3df531ff43f18
SHA512 8599eb4e2cdfb10b8822af3ab3f97e48362ab17ae7c89478c1defb47442d1bd51c7c7167fd2174e09766ec7a37619a11d25294fa0f0eeef65566d96dbc689d2b
SSDEEP 24576:zVbqPb88hv/lV7AsqjnhMgeiCl7G0nehbGZpbD:zVO88hXlVYDmg27RnWGj
TLSH
T16C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c7829c9cf5bfbcdc5a18e3435ab26c7a24ba31393196a80c7ce5de4eb5f9c6a5
MD5 e498871a448f749393e9c7b9aac918e1
SHA1 fffd5abea4e37c22cc2a45a8fedb628525e48fa3
SHA512 e5269575e3d7092e93293165aa0c29a9f6d26f7a1ea3f38be374b10aa68defdfa27a9e6c6aaac1bf698d2cafa3690830b2e9f9f5f1a766bdc1e9243e9902138d
SSDEEP 12288:MGHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MGHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF4523BF964C50CAEB7608B5C3E9F11DAC177E56982008436A637DFEE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4769b003491970de7e789c4721277b0549a8daf9fbcde2c6a32c3499df7f000f
MD5 b4708b1fc7409baf6f84802e95ecc021
SHA1 9ba63930c1c4f7c7682bfc0f81741491685baa54
SHA512 b09e0d59ecb5fc142157c9da68aedd9fb2dcc62e9f8a5f3daa3351ce28a08bc41e90bea67e072d612a148139ad79f2bd442a0d2fb66a1f5a1e2ca9e29415d055
SSDEEP 12288:MeBNUbTVO86UoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:MJIUosqjnhMgeiCl7G0nehbGZpbD
TLSH
T18165CF7BEE28FCD2C27A8DB85791C600E77278314B6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2d2372d96950644290534effe560ab9bda584cdc9201d7d6371cf84eebc3b139
MD5 e865048b9581bdec78ab2a5bfda954f9
SHA1 6f19ed484c4e7a7a683db92baf9145704c3a88ba
SHA512 aca08d3f26a6eb1d891ae037e1b701852c181de59d099d82a2283de7328b7a10c2b4cbddc1a2830cc88547c5dc0f9f1737281a422a2e077b33ebe5649d2ba101
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THH:BQvGAdlCEL8c/pRNw5CFD527BWG
TLSH
T1BF266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ba362604547a7a3cfd4528eb80e49592552f656d1bb7663f14cda8564df728c8
MD5 d15235309197b2c31075fada2d3d92ee
SHA1 6d5545924f4777b7dea2a81ca51ac1bc83fbc8b3
SHA512 65edd1ce4c2f4dd507750fb1ef17b1c7dddcb2270244591ce93216564a660aa5cbfcafa06e2ed5c1ba336cc843e7e8e76ef56bc8091a33008c7e33fc91b4acde
SSDEEP 12288:lAwSfxL/2Dc3xDLLmt0LDQewsAjmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:GwewsAjmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A75E031FA74E036C37B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b21253f6026f8ae1bee3d9b7cfc0e37837d04ad72e63e64ce44ff8f05e2c3dd0
MD5 7fbc911259a0036b1db2b39e6249e3c7
SHA1 83125427d38e33e69cf97937418d928063881d28
SHA512 5b66cfe54668a6e8ac510a1cee4ba7842635726d73446b185ba464ed45b846a625b7ee97ef818c51ee19c1ab9d3117a8b381738217741f1589e1e14ccbace288
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHSVQBWG:KUEtQevvqc2W1cpV29I32FB
TLSH
T149474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0741a1625bc68d3fcb3291d99c17c4e26029fd69695399958a4cbbe195ccb2c8
MD5 e81dc6e8676a143ab09db2ed972e3dd5
SHA1 f9199302656cf59d69041cf1d6f0025fff27613d
SHA512 67d7a86ea2e759fed05a193618dd4b3e3d313cd9373a3335bfba2b5067294e647177aafa709e7850fed509bdede178386951958c81befee3111ebb0a49661d74
SSDEEP 49152:hCbRquA/m2yL5zLfFiV+XenmE3/zKDmg27RnWGj:Ooq2VjnmJD527BWG
TLSH
T1E5D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 83d346faf6af647ef8224bd292baf56d82a18baa3b6df6f4264ed1789293f74b
MD5 ed6ecceecb10ab6d4e687ec40ae156c6
SHA1 514344c892af1ca518d3bb22732890f50c0826cc
SHA512 6b50c9ef982681e8aa1098e347c417cfef704684d6f3aa7d6762026250175073c903941865a8495fdeec6ac09d01a6210daa2c6474c98f0b46ac43988cbb538b
SSDEEP 24576:pAhGLmIFoiwtA5l7S531sqjnhMgeiCl7G0nehbGZpbD:pAM1Foiq55Dmg27RnWGj
TLSH
T15C359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 60898a479d4718b5183067fb5745875f035ba2fcc16afac90f0e265c7ca29b9d
MD5 bf28c7674866fe23924bc1e91b004b34
SHA1 dbaeccc8ef2bf6f028734305ebfc9e5528317533
SHA512 b8bf271628628267804ed2c82804f017ead6ff165cbd8111c03aaae3e33863e17a254af99349ea550fc0f238fa8dc290e0463cdcaa86df605d110a85c3f07816
SSDEEP 12288:pmw5HEjsChNOBFgl0WDm+ChXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:kwuXOW6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE65F15A76A81CF9E9674139C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2b72ee051283f1e8d69c0909f6d9d5c9c938969f8bdf202d9d3e5e8230fab0fc
MD5 ea44120e4ffc297670f0fd426e959248
SHA1 db702534d4ae5402db8a99f06452b94fe7a41fc3
SHA512 17db9fe99836b1ea3db0b508f72055f592d9277354be62b422af9b6593336127846407eaa4599f7ec36219dac574dcdfab4e1d5ce23d5bb43716e214371850a2
SSDEEP 12288:GbZ1IyWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1425512AA239820FAE163417CC5E5D609E7337C62673043CF16665AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f18a91fb33e33b9b9700748169cd07bbb6f9b0133a1e042b639e3772c06c4e90
MD5 27f357cc9d1641e62f4aa226545339b2
SHA1 91d88786609cb483ce9ea8397349ffb3e29e0a0e
SHA512 e3487a6f3bc03a8032d7bd708a81f65ee5c46f89f189db09a11f0fb439dac79529e37cf28dc37a7fe7a45261fa592af33329ae60823d3c8f8448541f7a93ccae
SSDEEP 98304:pQRQyi36YOcPuLvw2gAf+PN3oD527BWG:AQyiKakX+PN4VQBWG
TLSH
T165667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d3344bbf847a24807fc2f16d585d106dd3808784bae4182b9b2ac27d538b2539
MD5 a6c5491131412e982ca96a2416f6b18c
SHA1 2c1f2452749fcbe18dd08e2f551d25585bcb29b1
SHA512 b0b35afe5dbe960bd2fb99d7f1b0c1caf7a7dc3977051f97ae94ea735d8b3e7eee081c1270eead3ad079863bf88f907bed6588a2fc4a59771afb1723509fb14f
SSDEEP 98304:7QRQyi36YOcPuLvw2gAf+PN3oD527BWG:KQyiKakX+PN4VQBWG
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d2684598b6f6ea22e06beaa2c0449568993d145ea04f4026485c02168751e463
MD5 d0eaa00c4351ec7929ffd193cc13c214
SHA1 5700fe3a66ea3a8d98197cb2bf72a909d3c75b97
SHA512 99d84af46bdb3c2b113b94c0dfa3b0d33d657547ba053d412902fe63b8e79dbef8cf8c5568cb9e79ccc386a1e7ae4004ae087a2e81c6cbd924236c871427aaa6
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0DsqjnhMgeiCl7Ge:468Qg55nhxeWu7PNU3/6Dmg27RnWGj
TLSH
T126B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dbf2a79cf1c94a02d05044bd2e6706a49ee3210adaad9e50a1d137c50979e805
MD5 0802d7dce11d4ee3775cb09b5f959603
SHA1 1d348512579823c00bd40d108fc36be8f8d623f8
SHA512 3097387c93c721c55ec49655442d66295d2101bbba50d4f8b41d74a464f7987e656af0c1064ee4677f0e0abda704cf3b433be6dc6a70af60a6501968b698ea97
SSDEEP 98304:ky5112gYy5azzVvD69nLKnhZbD527BWG:lLIH+WhRVQBWG
TLSH
T1B9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 228426d22e8fb55e7c5816377738b26d3cee26ff04be1ff5153b5aa539a37ae8
MD5 e60372674e9e36ab9660bd3e45231a99
SHA1 e40683f944f5b45b4618cc15509afd48735ee16c
SHA512 0fd1cc679ee332de9273df5206f65bfad843a008366ce6166b5ab0915789dd49c2ebbf75dc485cfaecfa9f580e51ecbb3ddcfe31cf6825f52a718679b948b374
SSDEEP 49152:PB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glRDmg27RnWGj:xu6JmQxd2dRD527BWG
TLSH
T12BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 981a4831b0d7e8b41c9ebe57ddded5254f59562831be92e6e5a76234a8278cc3
MD5 0b3a06d8fcdf77b090d14166da2001c2
SHA1 920ef97a5ae14a6929ae5f5eab9b9621170662b6
SHA512 cf3970ff9579082f38e8bb196a489ae5c428dd0df98809102b8189bf8c530ca74117fbe7315ff60c8244fbabdd2db864e670c390a652671997784ec813d5c3c3
SSDEEP 49152:71hpsNoJpF1A6yU44CwH7R4x0Dmg27RnWGj:7mifPVRJD527BWG
TLSH
T1B7B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f71cba67070f04b2cdec682df8e22fb37111577a5fd34f6cad0a1cd5570bed71
MD5 ca1875f114d941119ccc334a4770b7bd
SHA1 3966f3b619216f4d7a4ef903cf0a005857cc3f5c
SHA512 39fb80016124afe8f37a2ea304302bd36f224b5a4553ca3ddb6827ef6a6b01439ef97c52d4d553bc1527533dd538921cb971d17b490adaa3eed9b13bdea1a0db
SSDEEP 49152:oSuZQIY0Be2KIRVtOnks6NMHq3Dmg27RnWGj:y5dKOi613D527BWG
TLSH
T11FC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 87b91585b3bcdf7dcad1e210f0a295867bf301ff5f20f5d550680d0dd015e4f7
MD5 9b610ca7930c5c94f7cffd471c7f0fa9
SHA1 7baa0eb75453cb0d56ab0a6e4473263c4d277651
SHA512 f7d3e671e746808c9d1b77deec99ff24339903bc23111cc5adf477d8a0fb8a3b1bcdba2de7f6efe1acc653f5387846478794007c23e8c9bbd1ff061c87b82669
SSDEEP 49152:2htSn8EApI0figGgiDn0AP5wwDmg27RnWGj:XX2i/phND527BWG
TLSH
T14D95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4967f4837259e47d0ad8c020e049a74d07608090ddf9f9820ee144ce2b32471a
MD5 aca0fc7ff33473cb8cc27cf681711bc9
SHA1 b480522ffde90de0d4a29b4d355ea13da5aca012
SHA512 43fc10de5cd431c92c0f5e64ddd614e565b4160a00807cb11e2220b38000b9ab1e5e4923112051123208229c0f5736f3438ea51de1c0a7481840dadee98fcda4
SSDEEP 12288:2vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FA4523BF964C41CBE52644B5C3E5F14DA8073E5BE92004837B9B7CBAFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6ea6edcbad18cc0c0d929f0b5c743949907436eb92e2f4297625c9d902b2551f
MD5 9588b813f549c32687a92dd1752ca668
SHA1 6fab6bc99ab9f0522da9b443fb8d2d87ef05cd84
SHA512 db489773dcf7fc2a5d096e5f1090cf0e2284eb0c38e8e227e394a532b9c512dedc1fb41100267448f23ebfb6c7106552526450db1ab2653d22d32caa14b43b14
SSDEEP 12288:SyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SysqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF964C41CAE52644B5C3E5F14DAC073E6BE92004837B9B7CBAFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 47d6aa42912bc14d3a53c35dc8de476b741cc16343d0b2c4488752141a01e419
MD5 cfb53c1ab4d6207f7d58d66e9bab01b2
SHA1 a1db6e7054cd6aec0fb01de2222cb0921cea0807
SHA512 a6ae32031532a9f448cecb295305595c258dd3c46ae7ca9503cc8769d8f2904db04a2001bc56ede0304a6ee4a4bc95f0612772bb52cc01f0b3d787bb66f2eceb
SSDEEP 12288:eQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BE964C41CAE52644B5C3E6F14DEC073E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 805262729b15e3d2a19e9ba0c0fe85df07976480ed076d673e4112b657eaac78
MD5 5b2589d95a1734c176d1ebc6935d666b
SHA1 41e5089bd1ebc642f4b59f9a93e71bb50f4e1ec3
SHA512 2807950341f8cd3df1832db828b8952e0cbacd1297ca652eadd1dff189ecef0e1e7b432aea9a9a0e44725400b80a908261dd5c9b8b1063d7634ed854ab11ff7c
SSDEEP 12288:EVVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ssqjnhMgeiCl7G0nehbGZpbD
TLSH
T15345236B675C00CAD83285B4C2F5E11DE8277D96E73005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 3c7ec87bf55ced7988dbe6966276a00c338f8bd98b6299fce59bd1157bb6e794
MD5 4ab6de8efa37848cb6096e55d723d607
SHA1 3e4dfd90719be710177a797dc18be753343f7570
SHA512 9ad979ec59988d5a61895d337f842188b80489e861d42bf3f3e3eb8fc090cd5f20f381aa1c79dbd489ab7f9064c426424867e7987478aa3c4ba2e7a709217f86
SSDEEP 12288:hNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1894523BF964C41CAE52604B5C3E6F14DAC173E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cd5f33e2d79089e844512ed0164dad36e83e433dd3a50ec24758a485557bcf24
MD5 2b4e0858c4a40f1e7f08931bd074a661
SHA1 55691d69df92c29c3a6637bb50498b317ce83522
SHA512 286159d779b8b750f1dea6556d4a42451076d550d5429af1dec89fdb2b0cf8b3ceac095419c4677f898907f21a795b96fce2151cde2474d5f64eff48b0ca3775
SSDEEP 12288:wuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wusqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BF964C41CBE52644B5C3E5F14DA8073E6BE92004837A9B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 161477b37eb82acf739e392f6d650641a177d96e8d251dae8c8c36e78ebc7e30
MD5 c8a85daa42ed8ccad9151b49c71ebdf0
SHA1 d80e5435f208a7d22013d02551be206659e37cb7
SHA512 5d8d1c442cf1062daf95a694779ebba45c1dfc14fbfd4f6c65a317f90625b5856a34a13a2e86e39a9fd32a495609818dcc51ac6fa5f8c0cb1c174104b913a181
SSDEEP 12288:eKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B4523BF964C41CAE62644B5C3E5F11DA8073E5BE92004837B9B7CBAF7B14684B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 793eefca8bea1da8c3a811f7c677526905b77e3d4f730b8dba5f3f739691516e
MD5 8603c12ae6a80515361be44a378db4cf
SHA1 4dabbce80b5810e18f6b74a71884bb2c1be47f52
SHA512 17ee4af86b70b9320b9da953ab317a6bf83fd8a3a75e9bda1dd6dfebba11c524dcf5398bd9177728417fe1a379d951733d82cf5ea106ceb117a11c009cf800db
SSDEEP 24576:0ZMJzFVSOSsqjnhMgeiCl7G0nehbGZpbD:0ZMJzfyDmg27RnWGj
TLSH
T18B6501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cbc3d4d3348d2c1753e327b36ed375ec9b6285383cd07da64ae97a7a5ae24212
MD5 a1d560ace602441e98bc0a3a306fab24
SHA1 3ee216f313c188a4bb4de5c43b5010881f41fe04
SHA512 3653080e7e7e8b779e6d9641dc8d9dbdd9f8756903d6ec578fe1bac1d080991d598b5af8e64cbc2d955f1d0f6ab32a89a4b40347af80421b6c88f4f522221003
SSDEEP 12288:jjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CF4523BF965C41CAE52604B5C3E5F14DAC073E5BE92004837A9B7CBEFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e9f4d12c0e7c0f0e674d2641b3b687e6061fe7c426d7d434f7a007d7446b4411
MD5 fe03aa082e383f953d918836f90f0c66
SHA1 6fddd7c04693b88afbb1a2c72ec474a8bf69c27f
SHA512 cd1842bbc75ed6b339e6572a6466f5c20a76bef660d235cf3d03e12da1bd3ec3c7c6564711f3651560f6efaad6946357f0bb58debb0829a1943b23ae225ed2b9
SSDEEP 12288:Y3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF964C41CAE52604B5C3E5F15DAC173E6BE92004837A9B7CBAFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 dd18c19b7c6a65c35f9e5dd4c84c401ac3d1c4c9b5ff0fda676e02ae9462eb5f
MD5 5bc1f9b24e46ed3de3fb2622f33416e1
SHA1 e00cf95408e14265cc76d17c0249b921984537f1
SHA512 c1bd562a07cba94529f03a8f3d61521b4ac80150771392ce4c936acf3662a5b26d833ae038fec8fd9fcd971384c9db3e3a230e3617e6e31bb1e67ff7b47c2060
SSDEEP 12288:TyPz5L8WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ezyWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18955025B73A430F9D1368178C5A29A06F7337C3657204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ea5534c903a79fd300776ca9ef8f03c1380710f00178e97f3c0b253ed589c6d1
MD5 cdd750715f2d7763b46d1513f4806c60
SHA1 aa911b10f112b2b4ee4bb0e0138e230cfc67e63d
SHA512 8dd5987b27cfb31aa43ae2723df811f8fab4d74303fdfd45244c79c019fbd0963188bb409b550e1954dc8f74ba11edb2e02bb3eb760710917cab3d3b0d39f60e
SSDEEP 12288:LjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1794523BF964C41CAE52604B5C3E5F15DAC073E5BE92004837A9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5f34751f41a4f5d8274039fe26eec806d55f77e3202bc5a9a4c446a6733dc91b
MD5 fb096d3da1a1daf057fe50172ce26651
SHA1 48d457fe447c733c8e517158636d23bd9947a71e
SHA512 b40b1c1c00666abba93fa0478ac37cd2d782e0331d36ada285bb6d759b880fe92efb5df1823abcea78197730730ace9bd3c7a334d11ec3b2d38c7a2247e5d118
SSDEEP 12288:yjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1224523BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 618d5e106dce8f186ece379893dec6b6d13dfe7249b48131a83a9ef317255243
MD5 9561bcfeb3a4eedff5f84e18df7a6e76
SHA1 745e7616f2c2d90567ba84c07d10fb518e8c2d2c
SHA512 81104f65c95ca707a2a12cc7ff7b80a23d82880606a53eb5ca3e5c226ffc4567fb82eecded0e2e414ab2a1e330749dc814f768477408c0bd4bc335b17ec310c6
SSDEEP 12288:RyPz5L8WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AzyWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11755025B73A430F9D1378178C5A29A06F7327C3657204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b1fe0e2efbc27234545ae8a8e798d4166b3f58d30bf2ebb9eeaca537a1eed5e0
MD5 03432e4056cad4f9f2164441e11b4ee7
SHA1 160cfa7009cc71ef4a26caf5ad75a670e9417c62
SHA512 3b5c2941000277d5b86fe468d552f179e79775adf2b8d064a96f23e339d2b799abeac89c84ff4b852595aec0b75736ca4cb300007e8bc861d555cb9ba97151b1
SSDEEP 24576:KTuaLl3z0zDgsqjnhMgeiCl7G0nehbGZpbD:KTdLljVDmg27RnWGj
TLSH
T1A36501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f3c675f370450ca1f7bfad848332b9f8c54835d2e9735f1a16cdd1ea1503d7ce
MD5 295bc12f768f34756bb601265cab0850
SHA1 46d18c9acb66d8f5079d3341dca363190f9b03aa
SHA512 6f81334bf249ad796d35f0269e149a8d3e16271b8373a1fd80ae4fb819091cf8dbb1a9fefac26e666e6e1aa3136f2df7b2284cf775ce0198dac75a8b43aa0ad2
SSDEEP 24576:S3xd9CHKy7GZcsqjnhMgeiCl7G0nehbGZpbD:0xd9CHKyayDmg27RnWGj
TLSH
T1E175CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 598c8474dcfa7493f91d4636a4a972e04a421ba2a7e55f4e05fa8c8200bbb064
MD5 2b97b3c74de5850ece6d989c350159cb
SHA1 e48e6bf3dd9277a28892f0ef2318590469108c74
SHA512 6486ba3a25d757f20aed8149ae79f679d75d79613ff79a4a69c49cca01924f22f1d0f3c1e06d50c582da2cc9dcc5924c37cb9cfdfe98bb712bd552824f6296ea
SSDEEP 12288:ZwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZwsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1524523BE965C41CAE52604B5C3E6F14DEC173E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b1ab45d448de4c5abad056ada78d5844f69affb230b6a2713da73376ba755fe1
MD5 80ea9ec76d28657cf5e2f43d5bff5c47
SHA1 3b8815c4f00ece958a12c1af3572743c90eb12af
SHA512 d0f1bf21fd174bf649926ef40cde52937db5f2f1dade693f79494417f8c794a66db49285b2b1194bbf60ed7a7d19cc0875a1d3df78fb9176214502de8d0ba8ee
SSDEEP 12288:72Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:72sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE965C41CAE52644F5C3EAE10DAC073E57E92004837B977CBAEBF54584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fe4fe308580d1ed42427493dc0fedeaa1cf7bc820db9365e4c9af4eb86202139
MD5 d05906296098abc2b2083e67f53d0ef9
SHA1 62cf421a266224602eacf115a208e6df59d3ae7a
SHA512 4db33f5ee9580135533b18d8cdf2d4d77154384ae7c2e2bf4f27cf3c1b421cfbcd3940fb0eda414eb09c4adaa13f01972f9ffe04bc898696c81ae5319014b1d5
SSDEEP 12288:f5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:f5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BF965C41CAE52604B5C3E5E15DAC073E5BE92004837A9B7CBDFBB28584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 851fa8b3754162215aa72d9a84cfb68007a58e36e062805260d4482060585ad4
MD5 01dd36198a75cdff8f50c6b950e8c6c7
SHA1 859d2e7b7f1b03ea2882b73651c0508877e91b4a
SHA512 af8dacb9b971b711db3070a3dc1f7ecb1a71fb910c6e72eecc3a7aee2f2e4a75489d02eaee82f27a6c6c201f93d5393e14a5a42c1d338a7d56acf534aaebe3aa
SSDEEP 12288:sjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA4523BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1c7ec878bed8b89526159bf3d1c2141d6ad94ea35e7f95c0ee2aa8ed7e985969
MD5 1e3f76facc43d213e2b650d31d8abad2
SHA1 f52d3b7a81691df73544234ed709e1c31b8c50f1
SHA512 fc9d2334fe62569b8f3e4a4dfca6593d5e8db00d0288a94077e0f324920e0ead2901234c59e0111403dd23dc3f83b101c1cc58dce4d8a484d6e1401044707308
SSDEEP 12288:5wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA4523BF964C41CAE52604B5C3E6F14DAC173E5BE92004837A9B7CBEFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 cff27b30efd9610dc321b1e5510bf824edcaefeb627a72488a570266f1cf2f49
MD5 8a5c2d41e4b00fe761d644656002b0df
SHA1 bc36d0454ceb4bfaa8b5fd938a5150f06e636189
SHA512 432c6038a247fa7454e5ca5b615dfaf8c8cb5c10b5263def32e84fbb51116a38419536da70499b49a4c77f81c882bcb133055a24818d084af149140fcd886b15
SSDEEP 12288:pbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BE965C41CAE52644F5C3E5E11DAC0B3E6BE92004837B977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f66f49c1401376080567793e7f8a38f84dbe73516901c1d00393f0f92dabe78d
MD5 11c327a2dbabc94b5122b0064577bdf5
SHA1 a0ee0448680444e8b876c10778052850e34de774
SHA512 7e939025188481fd898f7acecb11d940210b6f5f3d000d6c4b2e0ef2d6a6d2b905e90a366a6d1192a0afec2be3443135324064ca17a62f151530e858352f8e69
SSDEEP 12288:NNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13E4523BF964C41CAE52604B5C3E6F15DAC173E5BE92004837A9B7CBDFBB24584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 60f14dee507708d6bbd643d27b7684bbe6a021c3e15425937d5c39bfa4a49f74
MD5 386425e896086133287b69799ff43453
SHA1 2fac0d85e3041c4c075947c8c06a250181e8c6c2
SHA512 85ccb33dbe585dc01e9effe73c7f5759c9498d4856df86125b9d5d2ec469f48a6c9f6ebd6425674bcd6f391edcc29493bf8e6c8718cc40d00e0abcc16c11a1d1
SSDEEP 24576:9fwvOk9RX6wkyAInsqjnhMgeiCl7G0nehbGZpbD:BMnYI7Dmg27RnWGj
TLSH
T16C85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c4759b1cd302d90b45e5b53fca316d91ef8290c29a22357ffa66b7ffe9691f61
MD5 afbdb076fa8d4f0b92b62df9397ee97a
SHA1 b4ab5451b622745524a3cac810a5f6fcdc23b73c
SHA512 0a905f644471cb099e1df13b034bbe2f4d6295bc84ee99bc28d551849f2b30f197c6b780441e2598a084d55d195dafa554004c37c3ec543f7ffcf4ea312c731f
SSDEEP 49152:jYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QDmg27RnWGj:dySzPID527BWG
TLSH
T167066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ee8bd5c942aa62e39f1cc23cfcb162b578096f7c4b2b558837f816b3c14a7d36
MD5 2ac7eccf3f2b8880770895964f2ab30f
SHA1 1b0953277741e8dade8f3b7f1eb8272838e4d3a9
SHA512 37d76f16e314ca0af72edd4beffb74700d94070151f8f4007be9217b21b05bde7c2aa2a0bf0f09533ef59da9f7a3ddbdb06c569ba499ef54dcc948aac4428ab5
SSDEEP 24576:y47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYCsqjnhMgeiCl7G0nehbGZpbD:y47JUQjairIhCnDHUPfF/ADmg27RnWGj
TLSH
T13065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 f53f664be8580f422975320800d11e4e246ff694759d5621c4a95bf287fc9d64
MD5 6f423427d41233dbaf924c961c6878ef
SHA1 9f1d929e55fa4d8cbad998c1e8fa0fe68fe0aebf
SHA512 f477fb8138b88b6489336d9155a8fee2c17b8a3c068d372f7ebf28921d1599c3823726810dd77d21386ae53e2d2b3e02627a12f1b62eb452cccaea3822cb07a7
SSDEEP 12288:zksfzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F255015AD29802D8C06E6179C3969605F7333C2697E083CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 16KB
SHA256 2b7388259ccaee26c74b04e7cbe93c558db6b3b76818bf6569bb8e188082597d
MD5 a063eb8f8d1e43a5ba10f74bbe0ade21
SHA1 27c3c8d3b64e9cb0c70c01d92b8deeff483d4630
SHA512 4aec27444d6539bbfb9e0a6bfbe4df31a679f2cf4190e33ee0473a9a5c99be57488ad331c620a4c66eb9e49eb8fed3c1b642bde40b34ec5bf48051e74744e00a
SSDEEP 48:n7evUREK0kENRu+UKn1IfJ1UdZnUzA7llQ7lllxbVHRefYT9:n7V+LRTXO1SZUsllwlllHHReAx
TLSH
T15272EF51F750E520DDE202B088D6F7EE9339F2A88901139331C61BAECCD82C94E5FB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c18b44f634c022e18c8440fe10044927a2f1647006d663239344f24c62116517
MD5 02993d5e38f6a6ccac2386be1eda93f2
SHA1 1336c0256fd3d41230379f51bd6cf991b206e5e1
SHA512 5c4c9b64f85524056b966478a6666fd9660e2719d368891b78fa9b0f5621262b226361fc3a4a6493a9b703bc27c258f988da4ef1c08473e9a6b517f1a4978303
SSDEEP 12288:vF7rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D945237B934C518AF93605B482EAE12D680B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c5435063447e54d4325c0be7dc753bc8d93f6de6698912ffb5765b7288dc289f
MD5 b8aecd2e1fe420f5ff7b3428be8811db
SHA1 56a629c59228769eecfc844ed708bdc332a218f7
SHA512 66396517463542c0b58322153af2b968754fcbf80fbc14bf7e422efff3ed4ff093539f4f450c55acaa2ce8184e03981233fbe4c176be96bee2e3ed888fa26bc9
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYBsqjnhMgeiCl7G0nehbGZpbD:1gb4mBIBhGFGDmg27RnWGj
TLSH
T113659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 441f37f51d39bcdfcb89d658346dab61a5fcb8aed1466c03ca64bf84939cc849
MD5 c1da3b69dd7a079e0e5a8072d087a27b
SHA1 a9ffbd179e2b94e7e575d4c2c43317d76c4db13a
SHA512 03d3b38cc34b8e37fe88026e2a22322bd62e39bd3fc7fabcad28c6a80643a8347ed44cba427d9fcedaa9cd64ebdb8231ef6e32abde50e50a473cfec0336eac12
SSDEEP 24576:uG88u8FpJqH1nzria7/mSsqjnhMgeiCl7G0nehbGZpbD:l7ZFPqV6a7/dDmg27RnWGj
TLSH
T1BC85016577E401F1D477D138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 63c6359e4d5fc8ec73426fbaae7b0d818f4265a058570bbef73297dc4663d55e
MD5 0f62711db2a508e61e6cba6ff865ca05
SHA1 630754e3fa64cd996be6a7dce9fd452aca1648aa
SHA512 5d04eab9058f3792585a985786014bf485508027d99110a2b2e27273cb2d5dd40a637a81730e7d975c8737077bbf9761054f4baa3b1e736628dbecce447a39f2
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCDmg27RnWGj:bG05lO43bDD527BWG
TLSH
T11DD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7420901b287c07f07729c2b7d2624e8dc916cbf4908d4f840940b7f39d6141f0
MD5 7a218151bdabb3556ff837d19ac38f8d
SHA1 ab22a2bd315d017f99d63d699338de0fc7c34076
SHA512 7cdb32e25661a1f44860e211aedc576a8ff8a2e6518c46376aeb8be9e750a405c31b188125e8b470d04ca8f3c8ce2932404553a6eadab7efaea11f803b138062
SSDEEP 24576:hfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0sqjnhMgeiCl7G0nehbGZpbD:ha5POZ3hJt2pasx2+m6Dmg27RnWGj
TLSH
T12365BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a8d131dec8b901a0406252559b327ef65a194ae011a063a018ff46f875c263e4
MD5 c79e7e3890d603aa5e8380748b709e81
SHA1 a075fb19a3a0d9b50c1141e69588f294af55b2d3
SHA512 4522d01271950753b8f95bed0d160738e0556b17df5e501b0fce1f0bd3fe30a3ac594f3dae5fa6123e6f8d78b7512b0f6891b51c0e185c625d38565be6502263
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkasqjnhMgeiCl7G0nehbGZpbD:NNc/zEOVHF9Dmg27RnWGj
TLSH
T104857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 767703e4edb3545050b0287b229b10bad7533448f4db8174ef4d8577c83877e3
MD5 2c407273d9f7675f6934e9e136bd5037
SHA1 78a2f721b37c5ee5e5c2e0ea09b48f4136126fd0
SHA512 8252e141f07ccf4c3f84c8f3a21a7cd3abe7198d7817dd1c0a99d6f6c3a9b69c28e8f51eb89e2b407984f77b7d1621ba633b71a75e59f6966a5c45f90a94da34
SSDEEP 24576:h3kNvNnaFeYhJNtmZBmpsqjnhMgeiCl7G0nehbGZpbD:h3MwBtOmtDmg27RnWGj
TLSH
T1F055AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c13ada02730723355d3f220daac46a6724eceb2fa78c90b53b4d8ff227477e40
MD5 68484eae61408668f5795f6dd64d6c06
SHA1 cb9ccf8c2021a347d4a02a27d0cc5e2b1875d9c5
SHA512 4eb93a317ff298183508428145c3c8737fb4dbadb69c0d2920781d16c6a63f5780bc6fb43813b5a56dae9fe7cae584d4d42d5668dcf62d567c1dec74213c7510
SSDEEP 12288:dHvUrBFrEjwaQeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:dPUr+NQesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CD65F12F62AC18E5E676A17CC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e90f2625f08dd4a59134b9beb0bd27bc8b4ea7a6a11e34486429cc40e94ae0f3
MD5 e7d37c71c12190736f4d3071ff35f8a9
SHA1 1e2f3d47e2b5e37c44b122739f4f53a568846f92
SHA512 4defcf984e1a484e19d36ea6327d1b944cce87fee309418bc74df5bdc1fc5ab8ca82ec92fb997e5cdfc51802d37b44376b309ab61f0a6f953c78b33430ad12f0
SSDEEP 24576:iD3FHshBIYQgAPsqjnhMgeiCl7G0nehbGZpbD:iDVHeBIAAzDmg27RnWGj
TLSH
T1D075E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-517-0x000000000EBA0000-0x000000000ED0C000-memory.dmp

Download

memory/1176-47-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1176-1-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1176-0-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/1176-52-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/1176-9-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1760-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1760-285-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1760-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1760-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1984-87-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1984-82-0x0000000000A20000-0x0000000000A87000-memory.dmp

Download

memory/1984-315-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1984-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2120-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2120-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2120-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2120-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2288-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2288-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2288-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2288-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2308-111-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2308-105-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2308-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2308-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2308-319-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2308-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2744-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2744-118-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2744-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2744-55-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2744-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/2744-40-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/3692-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3692-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3692-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3692-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4104-346-0x000001F439510000-0x000001F439610000-memory.dmp

Download

memory/4104-345-0x000001F439510000-0x000001F439610000-memory.dmp

Download

memory/4104-358-0x000001FC3DD40000-0x000001FC3DD60000-memory.dmp

Download

memory/4104-347-0x000001F439510000-0x000001F439610000-memory.dmp

Download

memory/4104-369-0x000001FC3DE80000-0x000001FC3DEA0000-memory.dmp

Download

memory/4104-391-0x000001FC4E560000-0x000001FC4E580000-memory.dmp

Download

memory/4104-359-0x000001FC4E160000-0x000001FC4E260000-memory.dmp

Download

memory/5004-126-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5004-120-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5004-318-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5004-116-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5124-71-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5124-77-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5124-300-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5124-69-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5616-529-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5616-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5616-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5616-527-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5616-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5676-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5676-138-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5676-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5676-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5676-140-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download