767ee7958634cea0cbc046b533463b2baba461f8c9b7379e3012624d19640f3e

Analysis

max time kernel
86s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
Size 1.8MB
Sample260709-pyvy8aby3v
SHA256 767ee7958634cea0cbc046b533463b2baba461f8c9b7379e3012624d19640f3e
MD5 69f2c8ea645ff61fac8b0ca7e8aa63ec
SHA1 ed7e5fdb7e1d1370b0af9ed067a3aa4c0db2168b
SHA512 1647148442d00ee76e1e02543991672bd0bba83ce0678017d259ba2a2120123331891bddffd215a396d29f9b0119123c9178ddcf09ef49aff793ff305d4a7415
SSDEEP 24576:2SmK+DsAABx2DPx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IOxyLNiXicJFFRGNzj3
TLSH
T12985DF56A7E803B8E1F7C674C9824906FB777C0947B19ACF03D449A71F276A18E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
3676	elevation_service.exe
2372	elevation_service.exe
1308	maintenanceservice.exe
4804	OSE.EXE
4164	PerceptionSimulationService.exe
3544	perfhost.exe
2876	ReFsDedupSvc.exe
5704	SensorDataService.exe
3448	ssh-agent.exe
3428	AgentService.exe
3028	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6a9938784defa61.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e61492c4a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f45f9bc4a00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000638c33c9a00fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4e98ac4a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a37a6cc9a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e68637c9a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000273818c4a00fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{E9D76102-DFF3-4531-B6DD-F0741E94804B}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0200000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{668D5BDE-5E4F-45C7-8494-97FEDEBCD010}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3676	elevation_service.exe
3676	elevation_service.exe
3676	elevation_service.exe
3676	elevation_service.exe
3676	elevation_service.exe
3676	elevation_service.exe
3676	elevation_service.exe
6060	explorer.exe
6060	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5604	2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
Token: SeTakeOwnershipPrivilege	3676	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3428	AgentService.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: 33	3028	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3028	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3028	SearchIndexer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeDebugPrivilege	3676	elevation_service.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe
Token: SeShutdownPrivilege	6060	explorer.exe
Token: SeCreatePagefilePrivilege	6060	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
2836	sihost.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe
6060	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4908	StartMenuExperienceHost.exe
5416	SearchHost.exe
6060	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 5148	3028	SearchIndexer.exe	100
PID 3028 wrote to memory of 4048	3028	SearchIndexer.exe	101
PID 3028 wrote to memory of 4176	3028	SearchIndexer.exe	102
PID 3028 wrote to memory of 2468	3028	SearchIndexer.exe	103
PID 2836 wrote to memory of 6060	2836	sihost.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_69f2c8ea645ff61fac8b0ca7e8aa63ec_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4164

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5704

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1308

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6060

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5416

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2a2148ced6975664194be760eef6d196162958bdb4e68656f26479e94351a091
MD5 ba2a4f3a8a78276414b16abdab00d144
SHA1 cdcdfe871c5d0e1f4d394176a17eb63bb3f5d35c
SHA512 97fd7c725b1625227c7e35cfcd11130d95300b46b27b0bbd6fe632aa68893370da4e3b20700a6210e4ca09cbd9918c84ec39e1dcc95f291b3856283a7670b621
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn6LNiXicJFFRGNzj3:r3q6mjBt7wRGpj3
TLSH
T15CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 d7195495810da2cf2bce53b9c58619a44b469bac8b875f3620a4cbbf6898daeb
MD5 2dfdc436f644178895656e7bfe641a8f
SHA1 4447b333446b6b5d5a53e594bfea2295308fa0c1
SHA512 59d92be841dca233dcfe541158aa209372603b9dcaf2c1d8ff37968602f09af62ea3ce5b857c0a2040deceabf58eb2e9e008dcdffffc8cab6273f31466709a84
SSDEEP 24576:KXYfDtczAp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RtcYLNiXicJFFRGNzj3
TLSH
T13B75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b29c37b688d9fcef27b60c8eeb3ac8b059b6456d7eb687466f42b398ab7a0d7b
MD5 c5ba0ed6486064a8a434d32e1f7ade0a
SHA1 b826c99058ceb21f2124ee8c310ce09c5b44c269
SHA512 9520c26be87c63e92435e99e40c82a8eb46cb0dd56b03f608188eab535e3f0b5ef753368d701911fd60191a8a1b988206f722418d0b11efd70ec2c44d8b1c8ab
SSDEEP 24576:N0Le5ji0hmxhrMy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NPji0AzrLNiXicJFFRGNzj3
TLSH
T160859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6b437f444191c6674ac6db089eb099fdcb4e359105daa16110ce50ef0883421e
MD5 a8c34fe411f33f6decab73dd7fa928c5
SHA1 ec765a608c8b3f263f927f7230e909c667e86908
SHA512 0fe8a6b91f54137b8e2c649ad5d98e0d8530977d3567773644b8ec9505aa5622f2f4a4e051a8ca00d30374ac59637a84901f71dce91ff8502b927d99da17e175
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWj6q8wyuI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T/ezSC6vUzPv+Hjy3LNiXicJFFRGNzj3
TLSH
T1C5756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4aa764af2d7c40a0c474774a5d3086814ccc584e6b62a1ba9e8b0af322cd1edc
MD5 752287aca09995a9431bb9419d4130a6
SHA1 72e947f5769004a1defada988df94cb508cce06c
SHA512 1f8751da6954981a06055894fd6252e282552c15c08f8650f8e5bab41f632bbe2e1666b1bdb8ab95dfe686106cf3f3bd68c8f031b20049dc431ed608958bf0a7
SSDEEP 24576:0VbqPb88hv/l+Bd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0VO88hXl+LLNiXicJFFRGNzj3
TLSH
T171559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 36a217ad39cab86d78af68c7597f28543655613147b8ece23aa0598607518278
MD5 ad889a0c7556e14c5c6545bfc5b9a9eb
SHA1 aced5225272f29f43f9f2e43959c3b7a28794585
SHA512 455e9603f921d763550f04a990b04835f5120092401a9bbdd71b9e30d282fc233a4618b97d3468376c0732dabee717b2e0e8bce6255fce88212fe490770cb385
SSDEEP 24576:CGm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T1B25523D3468854B1FBFD003A867A5828B5845E2C8A595DE3D2543E5E923CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3cee034706c33729e9d7d5e6f62daaaa5c9e6b194806be2515efe1b7fdc36aba
MD5 91f2e758e01f9a4621319e0681475e1f
SHA1 a478dd9672fa1654d668f8b149976e9e0e8dc4a1
SHA512 bff6ed2af83c492507b5edf701177d3e096e343deccafefbaafad5184f91d263308b117c38c388e650895d85b00f8d641963cdd60f31e858b773386fba7b5086
SSDEEP 24576:dJIU1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dJIU1LNiXicJFFRGNzj3
TLSH
T17875CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c559d39bcee46572d75106d0646da13fcf34f49db3b6df593d4ef7d1995e56c8
MD5 bb169672e7703b8ae11a586d524be2ae
SHA1 bc0c1268aa415aa173e300bd12e27dd6bbe6bc24
SHA512 33d03744ba5a4c0ef88ba2b17716aba94c51e92987d20fca636ce8ffbc71ccd04f3a7e396a4f12731f7e31c52a23b095ad5574926fbbf5a500f5442d66e8bcd1
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THN:pQvGAdlCEL8c/WRNw5C47wRGpj3
TLSH
T14F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 91cc86c39b967b93ca38796b786d629e8e92aa7b526b0e9d49039cf75b963baa
MD5 7996c735abc16f0a106b2bea3643debc
SHA1 b5546502e3a9db0983e143558bdb488da94b3354
SHA512 ec2567e17f893983436cf370fc0c140f36ee0a2dc4640b3fa04e636cfe01878ac77d87c21b7372f8f402acdfd79d002259a670fdbb8dd4c65e126735207d6cff
SSDEEP 24576:qfewsAjb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QljbLNiXicJFFRGNzj3
TLSH
T1B975E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 213998a221476efb037cd62a4a27b2b7c8e437e0ca70616e74b0324c7f9e4a1f
MD5 0a03731e1dd89ea66de6d7e16fa0e533
SHA1 62c84df26468894e55563a50135d22a35751da2d
SHA512 0174dbc092d31334d74bf0ead81198b7fd638d0f97e53fad5ce3ee065c4d1a5b474a348fa1f827215b1e75e94b0f0f96401f4adaafcddc1fcfd803a7ba81fbe9
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH3F9:EUEtQevvqc2W1cpV20I3219
TLSH
T132474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aae4093ea870ab3949128cd7ccb57d25fe9fba7ef214699cc5839aa38f5e7403
MD5 62541a50ea605cf14ed842312cdaddc4
SHA1 1e9758999f5d1d7772954530a0c42d91ef2bdf67
SHA512 ebe796831e7b7c4e84e86f50899601ebdda3982d7540b01910d4d051f4661f093be3d12006b26121f44b008fdcd6721c49f319c8241b0fe3af9d8f230605dab3
SSDEEP 49152:MCbRquA/m2yL5zLfFiV+XenmE3/z7LNiXicJFFRGNzj3:loq2VjnmE7wRGpj3
TLSH
T126D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ac3a6700b49993f46f24e66a044add5801d442c1de6a5ff254ac5336f2180961
MD5 07c9b7f610ba2a23af9d9113893380a3
SHA1 97f3a045bcb1a0ac5ed4e6487dfdfba251a3e9cb
SHA512 7b21b932c3f046c1da7d34bed2d56a62924a30877ef5a2e0a8588a315f3163184b17d7a8e36c67d71ac3ba8157d15d98962e46473bf53bc0c4021f7b14301008
SSDEEP 24576:YAhGL6IFoiwtA5l7S53k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YAM5Foiq50LNiXicJFFRGNzj3
TLSH
T19E359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 84a1739410fae18f0f51e0bbfa212938099e7256f6c4ff5cfc8da7dbcfc8c24f
MD5 69cd55d78bb020f0f95ee33587683865
SHA1 8bf3c00fbe3b67be38c230250b5f150bcce7c274
SHA512 51226ab4e1763bb2cf1c0f3777074597bf8466423e98e2b8f08cb6d1461d49722dbd9de44a607292a19dff49ebd074d45e95c2e53ee7d5970d2a7f8139112e96
SSDEEP 24576:TwuROWX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TwSOgLNiXicJFFRGNzj3
TLSH
T1C965F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5cdbca69b3fe8280e79663b0b420bf3435c058ed2c84630689018353a59b5679
MD5 a86a2ad83830d24c1b0514543dd7f00a
SHA1 872d1fdc2f3a4a7ce3a30a0be24113f897aa08d0
SHA512 764be42603f52bc9d1a09dfd837bd966d46c5a7f110751bfde3b9a6a4e8445ba0d48bfa670ae1b406f4bcf5e6b5859aef3e5e27b6ddf30a478e32cd93d503cd0
SSDEEP 24576:hZuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VLNiXicJFFRGNzj3
TLSH
T1E155129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 17869d965cb26f0ad43edaa828688da2a32b548e340edfc322638c1e337b5d9e
MD5 70190cbe11557ea1a42e5e813d9fc864
SHA1 c31a5a1d81ebfba19fe4d0937055e0d6a60cd601
SHA512 51a70c984308a05a40bd5253c15ab1da91a85f14c8e45d529063432ce4a83812ff44ce34ab3d2fd9807f42d5fa50621274e54ca630569d12d7645bbbb1f33da6
SSDEEP 98304:FQRQyi36YOcPDLvw2gAf+PN3h7wRGpj3:8QyiKanX+PNVF9
TLSH
T117667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 48c5b6388b5c04a09b16e8e10cb831e30edc69516732d45ca68f7796e63f9338
MD5 e98e4589d6d554e506ee7d770c0a0e68
SHA1 6511b0cc103d5455c75b31c4fee7cafdc9917602
SHA512 f96a8bc975f8730206b8f347b2d3b909556d58af348b4ef9f3a95d26508d91cf66d66f8433519967a1477fd13cade6238404e5863c49c679e34b3d047d523399
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3h7wRGpj3:JQyiKanX+PNVF9
TLSH
T112667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f4d7a67d94266f1c6c3991c6ae1dcec3090b4bacbc39515f702c6eb58f4f35c7
MD5 2f412f65a8bd0b64b79363c3e6396100
SHA1 6844220ca969aa931119d43048a34ef56dc04282
SHA512 462a691339f5e632a85dbac0d7c2b1417080bde8adc205da82351f1e7c9575ae6a565ee797a5e8dafa1834f73e1242e082827cbc4f49268e1567e0dda32c5783
SSDEEP 49152:568Qg55nhkeWu7PNU3/rLNiXicJFFRGNzj3:HthTRc/r7wRGpj3
TLSH
T1ACB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4e8b17e64495cb37c81e86bad99ced5418393e5c2f6b3cc6b542bda761bd5a96
MD5 396d6ea9171b0e978624581e7699bdef
SHA1 6917ac831a7c064b0d446d0e5ac399b155653960
SHA512 fe4d1b702ad793ec46703c095b077303d2f3fd1d34530509d432e9be0e2e2944f51a434e3e3c8573ea646124f60726892c8ef3101e22a98487ced0493728a663
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZm7wRGpj3:eLIHRWhIF9
TLSH
T1A9167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0a6567d81090e60a179be251478c1d0562adbe4d74e713e1cb31c21c8447245b
MD5 e41163776404ed2059d0db8728032ecc
SHA1 6e2aa3c5c11d3b852a8279c8567d3b159269d77e
SHA512 90b73c83e075842f64fc400ee66c1e8c2ac7b7eaac15344825a0980f9892aa73f1ea60e00c7fa6572aed4c04fb6ffda9a0a82271ef8ece91515f3466fa83880c
SSDEEP 49152:XB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl7LNiXicJFFRGNzj3:5u6JmIxd2d77wRGpj3
TLSH
T1F2D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 95346eb1be5f7baf0f78e91c04a9474f278dc646e2b6165a5874827fd2c7db88
MD5 c7ba188b3901186cc78d68a76312eaf0
SHA1 f32c5dbc52e7c6cff7f5027c5aa267f9c8de3841
SHA512 8e0c07d2f2bc7a0739baf8097a5e3f1b2b465b792a0fd06120fcdc434a93b4f4adbe89ed40ff01e7cd3b72453022db2c6588f39d781c0d0f97ae057e96f5e538
SSDEEP 49152:L1hpsNoJpF1A67U44CwH7R4xVLNiXicJFFRGNzj3:LmifPqRE7wRGpj3
TLSH
T190B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8d902154a28fa7a8d81f0c929c3e51ed375326ba182d13627e70679900aae88a
MD5 772f189a9208bd54f3bbe6ad01bfc9f6
SHA1 e381a0cfe81c4cc1c40c70dcd06f2f7c07760ba8
SHA512 e25a07f26df22a97bce72187da16a8d61d88c7a00689e9c52ee70adf234809c2f8a913011d4767a769329ed6c60bc45538c432df1c4be5d8b3ef777ef128e7b0
SSDEEP 49152:5SuZQIY0Be2KkRVtOnks6NMHqqLNiXicJFFRGNzj3:X5dKqi61q7wRGpj3
TLSH
T120C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9435b1adaeb5f6d747e2b8ba9ef7f1217a44c035488609d96fdf75e4fecef022
MD5 395dd314bf265f4462b4c7b70dfc6da2
SHA1 60d774bc88b35c81ef376bf1c7f34d4b0a2dada2
SHA512 519630afc744120ba474cea3165942b1631bb4d194ff60948b2580ab9c2313b4b3dfd3d9899e7cffc87878cd548567abafe3bce22a9d5f40a003218e65f4dbf1
SSDEEP 49152:IhtSn8EApI0figjgiDn0AP5wpLNiXicJFFRGNzj3:ZX2iWphA7wRGpj3
TLSH
T1CC95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9c1730eb234482aed74f15f0069b5d86283cc33a8312d0f027439c8b4878e078
MD5 6971a564704f86541982e7342dffdbe1
SHA1 76575684989bd9bc7718eb6a4fdb41cedba746a8
SHA512 14a613c678327bd4d9e3f9742bc310d8b078d389e71634aaf5df4dbcde43b5297e6c410d78b4580930251eefbd9b326452b3a852cc68336a6a648b5e246c7514
SSDEEP 12288:AUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3558955B1FAFC0039C6764428F5882E2DDB5618E3E3183D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ad67b448018aeed095264aacc5a40447730f020696a6f741a39e6846fdb243fd
MD5 17af8befec91e9e2860f3b1d3f1ce822
SHA1 fd6ea5225b7fdc2eea4a81c8a1d8be5bbb7280ac
SHA512 9655761982bedbf1e60e68ab450acdf1648b36711c85e774c3962f6053ce509854bfd9768e84bbfbe5b46b00122bf7430ebe37b5851a1d0767a6ee25bf6db461
SSDEEP 12288:0riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3548955B1F6BC003986764428F5882E2DEB5619E3E3183D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 01fc859db23a3c6d051d3ad791c69dbc475adf3eeaaf7a4161e97434b9bd9c81
MD5 6a8229da453e9aceb72afe0ca9b003bc
SHA1 2ab468e2ced2256a590fc9854c737b824f74a1dd
SHA512 4ae42e6a6fe3ae49080c54a6b4ee789fd8c185085776159290b58718103cef0e429d8a4eb7ce074356392ed1b520927dee0b2c88f0e2596c0f65b6ba78514829
SSDEEP 12288:mBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3548955B1F6FC003A86764428F5881E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 924a0a9814628b51c99759754c67512b47fb7b53eecbc8c8bc6519f8be831d3a
MD5 5c2482f5e09e3ec6a76d719957cfac01
SHA1 6cba6208513e1440f676d13cca8e43c68dd03cd3
SHA512 87c7ac3268f89dc12d1dbc9bfd47bae332a8ddb98eebe20af70340e5239ba988e2b677d2dad9dd8a5204db96811cc002e4fb4f571ecf0639d04e1dc9a3d12855
SSDEEP 12288:IVCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E7552393168900F1E9BD8039C6764424F2A47D6CD7325AEBD3003D1E5A75FEA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6de4d2e06150b42cc662fc825ebf65d40ef0442a474cf8e2f081dfe8478fea40
MD5 9b5b9efd73f195bd42dd0130d9ef88ea
SHA1 965405a0bd7ac4e5dcfaab08081349754d64b748
SHA512 3b55b2ec188880a4c8110f3498569a43ccb57dbabeda5ade94cdabff2a5b412d3fd2c5c5cffef8098713b92c4402786fbdc1f6951df9080998cfb14e331a6e96
SSDEEP 12288:XqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Xs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B05523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5fa7ec20c50a4b977f8dc804bd466ffa449ec29707243eec2a338f20863a2864
MD5 d5c68d81dd681ca5b9e33b89d9288935
SHA1 b35b368f492f3f21b2598784e86dd3d4f0261c05
SHA512 0fd778de7d12f30c188a06b80d4e5672ff60b17ed54c16ac4fe0e6444c9c4e4302082344b39441dc34f8e443c435859e1adc42bd9e9486be8cd43b4555a571e3
SSDEEP 12288:gHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3548955B1F6BC003986754428F5882E2DEB5619E3E2483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 99fc4ab541e3327326f2f0a83fd5dd1d41093e120b5ef9d05e642a649367ce4e
MD5 badd8e5d2475f8ab5289b610b2b42377
SHA1 408f59be4d745600344a92569899c6a146c49483
SHA512 d515ccac21255a78bd251890f6165f5324fe5973723c7a45622a1aeab5fa4a4f7367fb970d012746c3d504ce888b4536b77aecd666e533cd08195163419ec045
SSDEEP 12288:7TiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3548955B1FABC003986354428F5882E2DEB5659E3E3183D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b51f3e4f0574c6aa8610345863d86bdb8173c1fd0a2a9c9cd17e6dba341d2763
MD5 a5dc23f2681fa01ab8b12eb8cc1bba6b
SHA1 74e76a9f615a8aa231542deece8bad294cebd8db
SHA512 e6ec7d73c8d40d4af6991585d08ab472ac2e4304186b8cf070822faa90b1bd4fdff495db758ea76c6f08854830bc879922a887e23332ff6367facc6d7b309f97
SSDEEP 24576:WZM3zFVSOf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WZM3zfjLNiXicJFFRGNzj3
TLSH
T1DB750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 102a25ea07503d1663fb129c55d74dc09cbf0ad0bae8b93d2da83590fb8e4437
MD5 5f9ec704f52b8a000b3409b1295bdd60
SHA1 a661f41f22f672aecb2ced57ca7eb4dd4ef86f99
SHA512 ec87b6143eabbf46786200fa4dc91185dc2b5241041440bb39b413a763463fc929ebfa3c86fecb1a6f8f4595670adbed90704f3572f026cda0df57806ab4ff54
SSDEEP 12288:RoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ra/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3548955B1FAFC003D86764428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6561a8804589aa52654b8193c3f472ffbd89ff93737ed7e89e610e62872a2da7
MD5 810432167163fe8462e1666e1e693f23
SHA1 9c71cde3849f977478d67c0dfbad0a086ad8f3e3
SHA512 9d6a58e4849561b1a9d2b8adbbb2f5f56426fe38aa499d5f01a0607b8c1d611698dfbb79ff81f1833d1d785d5e58af741df2dae26b553f944a324331e4551bb8
SSDEEP 12288:MsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1FABC003986754428F5882E2DEB5619E3E3183D1EA278FEB8F3C476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ee7ffc863be4ff568b7c6935284e8e5fb40bead6f49788b6e68b04e6bc186931
MD5 79642488a4f7f84496cd6c781754da69
SHA1 0032417efb30ef89eb7cb676cd303379f97b8bd7
SHA512 5ea573396841d97a2793fe1e1de8fea923acf1dfedfe859b8aac83d9d11c6b1ea412de8d6449c3297a4ae7bab5c35872167b24037f80313a561a16d9a5b9d927
SSDEEP 24576:EzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EALNiXicJFFRGNzj3
TLSH
T14D650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a948e08ef3f0eb26ba197e8d3d954da4ea51ed4b0d86554251fb77a9f522c79a
MD5 726898f2d05a15711c4a37877d34d31f
SHA1 7b2e244a626bbb9e474cf6ccc44914056600fe4d
SHA512 5383388d9e318f8c0697a6eea67f2baf840700ce7411cd87c54d2c0b351fc90c57e4283a3cd5dfb954a05fd60f35320b7240d5bbddc0bc02ff2aaf1e20a3e870
SSDEEP 12288:ZoiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Za/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C5523D3548955B1FAFC003986764428F5881E2DEB5619E3E2483D1EE278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e4f0625abc3b02cf6a1c6c753dbab39ae38df91c7533eef7b2baa3fa57a41781
MD5 8b7e5968ca0182aa81cf6e1f6a66b599
SHA1 b599d990abf8d32a27cbc31a6fba558a4474e11a
SHA512 25a16ed750adbeb64611e0ebf87191759e91fadbde93eb5253439623d760bdc1d851b2f6a9095d2a8567cd3906c56c7af716fe7ff260a626d25d6486129a480e
SSDEEP 12288:2oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AB5523D3548955B1FAFC003D86754428F5882E2DEB5619E3E2083D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 77acfa87252b11eff3d5ed03fa1631183d7a8c9cf900a8321c01bf0dc1417f43
MD5 333b8d2d4fca720b0f8c09153b19ed3a
SHA1 2cfdafc18cd62b13756e1afacea62bcd22dfdf16
SHA512 a6f63701ffccab6a479eb1e8a7d25ecad7dac896d8c292103757a40fc1d64887d4e60e1040ba077683d0ef482d5992211b060fca5cad3ab0401e59872ed41bd0
SSDEEP 24576:DzyL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DALNiXicJFFRGNzj3
TLSH
T14D650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 1e1d79889e8015d5514af70a000001ae8b6bdf4da8f9e37422afebb0139c6cfb
MD5 c477ecdaf9fdf8ec8c1015adabf625d4
SHA1 2e4dcde03407fa96e9992059fc2314253faddb10
SHA512 3713761234d6846562fc3bc306a653b0a965de778cb3c78ee1cf4c518df8e55fa98623259a277f5860408fe97d45bd77e690e1bf695cfc54b18b02b0a282f9f9
SSDEEP 24576:IT8aLl3z0zD9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IT7LljILNiXicJFFRGNzj3
TLSH
T10C7502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6ba83eb154fb0ca9009ca0e98693e52f7ecb505362b827926ed464a2ac49c5e5
MD5 a52188a0f7c5450ba38f7fdc7c522f8e
SHA1 87fb55ec64656075525c1eb4550c126f442d9388
SHA512 c9d7aa34a1f0aed100790a2857f9f362aa1d0dbfa0d4a97c9992e0161a99a0caac941046f2ecc4b7a7cfb9c76d945e895fb8ca9f54762c05556b2e0c8396f59d
SSDEEP 24576:23rd9CHKy7GZB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Yrd9CHKyajLNiXicJFFRGNzj3
TLSH
T1AE85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 abc24fef0537c3614fad7ee4d8254d0ad5856773285a83f22266e0e54c452d7b
MD5 d5b9641625d99cd438ce5afd0d0111c7
SHA1 60540512fe0230345f67b957a844cd4f1c25ba9f
SHA512 6bb415cdd8dcbfa6f42872b43cf13f45b3520acaeacf22f24a730499f4b77adc79765f89bcc3870ef090e614d51406404cd777c86b1dbcde66667aa1712a0f34
SSDEEP 12288:8hiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1785523D3548955B1FAFC0039C6364428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0b57b0ff84ea0e578a27aa460f4f91ed2c6af9ead9d06011e0eb5ebc13e8a4aa
MD5 78057236a00ccf065515d25ffe5b6c0b
SHA1 c3fe0a924b92f1bf0fbd04497004beb1a6daa35a
SHA512 4a0735cd1a58fb28e61840b569f3b11b788cc102cdb39fc7f5425d28d1eea5eff2e6a4c8cb86cfe1774174fc25d6e0976b5f5c43aa63f2fce73ce5078a38b3a2
SSDEEP 12288:DfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1915523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1ce332f9939cb6de625647a6d8fa914bda202ec72e2f904116ef8a9738f6db86
MD5 6fb66da5b86b51decbf5de1635354e7c
SHA1 5231bb92dcebea7c9184dc0ec470bf3876e30760
SHA512 e29980ec3c2afaa05f84a8027181b40ed0db1ad0b5cfabc828b4bad5c7241ae10ba8f63a59d075bc3e4dbe2ab59263c31eb097d1a70461fb7c78bd942d587a12
SSDEEP 12288:NGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15F5523D3548955B1FAFC003D86754428F5882E1DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 362baf19bc185f6f020c3e05b099ec27d725de7b7450ebd87f666838032f5633
MD5 2eb1da833f47aee3f21d1be6e38996c6
SHA1 97655ac24777385d23cacfad80d30f87ee19d687
SHA512 0667cb0971d0da168c2c3bb476b6857144be86a709fc33bed845f5d6e0abca2fb12a7b559bbecb0669f602d2b821e5e66caf0aa20b9eb9a66282c2579d2abbf6
SSDEEP 12288:ToiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ta/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1FAFC003D86354428F5882E2DEB5619E3E2583D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f934ce9c12f56bc9e0972f182613bb2f78f1fcddd7cf9cd1191db022c0bbee73
MD5 f93a096ac13d88a0db6867d21bd7fbb2
SHA1 97525325f5e12572daa05ff7d9c5ad8279263fe9
SHA512 4699880878122364591896e664611c5d0843ec23dd8c1438d6503138f6813a1e06160ae0b72eeeee971b5e5888d34b830e3b0c78ed9f3e3817e75af8aee1f939
SSDEEP 12288:ihiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CF5523D3548955B1FAFC003986764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4c5a8412cff0e573dd915a3e1ec74e821c798c2348745a58602393031f4d3eb9
MD5 56e4d44b00f4c7a1773537143b2250e5
SHA1 600552875bb1ff093a22d07b5637d147d0528242
SHA512 bbbb725776be3839487047abef135860d66d6d358f38bc3e77e0ef8eff5c958b9e8e8762f32dddedbaaff24e19b32e4664ec59167dd1c799dc94331b409662d1
SSDEEP 12288:KQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:KC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1455523D3548955B1EABC0039C6764428F5882E2DEB5619E3E3143D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d4d48ff58b3f58f34ddefea0e6a0d6c01e4a12494bd5731d2852f99b3f32ac18
MD5 a3760578b400183fbe5e5178b2f97d41
SHA1 dd66465c624540897b337fc5815e7e0f8f235b8b
SHA512 002d1a77c1927af8bc4e003cf5d085bab58146e88734f2c899ac4929332204f25682b6e985241940791c63409ae0524f113add349ad19af75a6c7816cf5f3811
SSDEEP 12288:BqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Bs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D3548955B1FAFC0039C6764428F5881E2DEB5619E3E2483D1EA278FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 7c634409b4a659c822102856f0b28b1035d82009c2d9caca7b7a08d15bdbf250
MD5 0097b23d38db89634aa16e314f35014e
SHA1 2f2d47872bf3a877f209608a9299deea41c721c8
SHA512 4c65483adc63b3f0b298cbf084977eaeef9240ea3089e52820f96a28ec93547a25659a5dfc5ccc50b1d0684ceb31ea1b9f37e70ff5d65ec59c9fba05900e2bed
SSDEEP 24576:dfwvzk9RX6wkyAIG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UMnYIGLNiXicJFFRGNzj3
TLSH
T14285DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7e98288f5825542a869a672ed7df5dc6a6a57d19c53eceef758cbce98f50d700
MD5 b83e49326391f605d42902137a39f0ad
SHA1 cbcac49c6faf0765279389b81c7cd18be74c17bc
SHA512 24260a48967ffd31708c7af73ddb80c48baf83d62205b1390ee26b29ca6728aa7704c02704380774cb50695d36c6870671a596ec84b587ede06530ded743b91e
SSDEEP 49152:nYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JLNiXicJFFRGN:KySzPB7wRGpj3
TLSH
T1DA066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a31285bdec9d5c901b4b6b657bc6d78f76b821764a2e35801f1b6f330566c994
MD5 3b99cdc335ae1f1365ba91050a2c706c
SHA1 97e43be3fc2f3274817d1881bc04a2cbbd7f954a
SHA512 792901836c6c5a67bdb2aad0e2f4c5f6f28cde7e2f728b6cf78cd7a25e5d27d681c7bc210faa15acdd1d4701004614cb0a5faed384cb2bad9972a2228991b65f
SSDEEP 24576:t47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:t47JUQjqirIhCnDHUPfF/5LNiXicJFFS
TLSH
T11065AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 0b05087c735c3fb4d2c8fef4a62a0532b7f5d0269281a1ee8e7ae3ec9dea182c
MD5 1457bb705d84fee13a0a9cf53f0ab58c
SHA1 e7fb95291071f2793b55cf22240058c2789e54cd
SHA512 5082206de0abfa7c4cbbff89e4f467680cb4d3610c07bf9fbd5129b0b06b4e57ac3d25d29ce90beef4aa2804e3d3285373db5b5f49b1d426188eba65ed6f13a3
SSDEEP 12288:BpsfYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15B65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 adb9b3b82176d8a8a87b69ec94f573ce98507bae64c99c5b3609d6c59ccf8b79
MD5 45d44231f7400f65862e3c247eea07ff
SHA1 7f83299841eafc25d9fbfad0ebdbee8032d44799
SHA512 fea00aa3d9fc39cabf57a34411a9a052d2895db2c91ce2782baf376f78f414ba03ba9ff0f953f1d456a805a15c2d609c8b3127a355313ec5157d6f093b4fc5d8
SSDEEP 12288:AhL2Ai4yN7axKqYl6QGmEP4saLN8G++/DfAKEQP6G+9:ARHIWuF9rr9EEF+9
TLSH
T1C64517517666C64FC6AD84321E32D1CCA7B07D41EE046F0773C88B3FD576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 47f20f80bf259f39e60ce5dfbd5c4836863034a2da4c14e470f51b5eddb3072c
MD5 fd61c7b7cd28dbb0cebe08af3104c6f7
SHA1 c0a83260c4863de685e6c6d083919ff8f95a98db
SHA512 2d91ca7bf758891c7a09368c0130f42efef678b875626243cb060c3b2249f9c683193e41938279cc64e89c0a5e04abca8709037588a336d2d73136133cf094c2
SSDEEP 6144:4fKDe1HKcCvsOdJjMKKOYY1MBq1JqIUHqItD9T22hfKDe1HQKDe1ZKKfKDe1HzfN:nJj1TaBqTupD9T22v8ecKRSzzWYL
TLSH
T18775F940A136A38FD1F750B207269F8DB7A4EC02B7056F16B3CC457AD86AB15A0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 927bbc98e89854732a7d1ca381d6324013db1745051ceb5f1ee42a41c6e5d6c2
MD5 02fbb8b62468d206e9fad1f72b3d9451
SHA1 2b3a4a2d52ff2ce92dfd8bd7662d6907efc5cdbf
SHA512 4e53f2ba5c09eb70562d641afbf3281a7884e742b082c6a67fad2ad474e62651f5ca5c8491f5da7e1684209c7926825f6d8917708cfb4aad17d1117edf3bdbfb
SSDEEP 12288:WF7AiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D3552393468D59B1FAFD0039857A8438B54D7E2C9F1594E3E2043A5EA238FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8dad7e84ec0bdcadd08141181b8f96a4504a1ee8fd176c9ead22582dd7f7aa99
MD5 b4b55b0b275095c7b5ab2f5cb3c9845a
SHA1 c317cc67a242d0f067ce7037c8c2af4a07ffdd21
SHA512 79c7810121ee67d2eaaa14067a6ee4109a1f53e1c24db247f6918189b1f49c826fb502dd0209053d9c89fb59846ebf6798a8be747c6d614459fbf46d5438efaf
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ggb4mBIBhGFPLNiXicJFFRGNzj3
TLSH
T1E365AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3015979e7484980219d8b63c65b76002aebfb3542046ffdc8d9f47353b40714f
MD5 58c1bce02008bfa19587bdf31d264c0c
SHA1 075caeafdae80a2ae1f17b939a33be179c27e826
SHA512 d051ed81fcc83a43ae57ba7e5eefb8b28ef2feaf25d71d72899f9c63f1bf53a5177b9305d448e31cf533ef87ce0e5cc8ad52c9d33910ffe58eb8aa189d3381aa
SSDEEP 24576:SG88u8FpJqH1vzria7/mf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J7ZFPqVya7/QLNiXicJFFRGNzj3
TLSH
T14D85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 11e64c961eee6ae0484fc2e800c15a01825148bb889d994dca93e6a98a6e7c58
MD5 f1f5d00e3385ca3f269ef078cec88d0c
SHA1 48929e529c7bfc476c69347c962353897c132990
SHA512 8849ce9e9b42952566eee1ca4d45ed73f087521be1851fa8585ccda8e7402e4dbcf59611d5af682003a2b0bb148c972e76025458256dc9070ad9da2eba70b906
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzLNiXicJFFRGNzj3:PG05lO43bu7wRGpj3
TLSH
T1A6D5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2957de3df4639fcd4c0e35379a2c00476f92c58c9838713a0bdc8c5979b1892f
MD5 41f2fcd162be3c7d4580ccc85ade49b7
SHA1 5e6d80ab04c4b88aba604655058d24049185bb4a
SHA512 5c2dba84c347ac931fca620f7d8633ec5e0f3279f715a4a96d35c7050e16f0a42df4e64ce547a3e931dfcbda1b65dc31828df1c8bd4fb23d8ca861b664bb710b
SSDEEP 24576:xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnJ/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ra5POZ3lJt2pasx2+mrLNiXicJFFRGNf
TLSH
T19965BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 889ede8d33ac118fba86d2cb78029b4c2df37f5b41cdfe729ca6c7e28f145434
MD5 7702669ae8f4c6662cf695ee70323047
SHA1 6838b5225f7f8afd5aaea64ce4fe068755b78222
SHA512 0bf12675aaa528ee407f7c78035d7cd8a80bc287fb8f4e4719a4d65aabf9329a3725361bbe05df6fa87559b3b31d7b2553e28b25125d112a3b0422afa19e272d
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7Fk3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Nc/zEOVHFwLNiXicJFFRGNzj3
TLSH
T169858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2e6899309f6350a285054a778d37ee2a02ec911f5a099c831c7e48e2a111426b
MD5 c193b18234b29b3a776de31ccce8e483
SHA1 77226a5bc36018d341453720606589634e7334b3
SHA512 6ee1e74bdd20f115528cb8c9c8d5b86dc096d2075107a1977a04bbd50373ad75f504892561a7b25b5b823f3ac448d761f11d14aeefe7b6b4623201359ae1e836
SSDEEP 24576:zzkNvNnaFeYhJNtmZBmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:zzMwBtOmHLNiXicJFFRGNzj3
TLSH
T1BF55AF6EB6A806E4D1FEC675CD238512F6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 1ccc0ef34f9ab846e4b5211b77fcff6f7a361c7536ef1c3d708a1533a9010e5a
MD5 e9d00d4e7bfc1476576623cd45f6614f
SHA1 cd59f70dc16037f624b7e1a52a459f0828807c2f
SHA512 a113d0e4d5da0d622ac79351ae5ca65d5da824a16187661dbe4365fe1969422f0ecb4198ea772832db2d24f48336b882f0c76928c3b05e179b77e635647da6eb
SSDEEP 24576:9PUr+NQj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9JQjLNiXicJFFRGNzj3
TLSH
T17365F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9163d59a4d9ef4ec400bce10cd7d89792e78c50fb338ae1d73e33d6258214adc
MD5 61f6d982525a45487304a669f271b312
SHA1 16ccc340e9ba331556732dde39020075e4782c86
SHA512 622c34961f386d683de8ff6bae45dd7f6907d0b2e78266cd729318151174697f577c8c1c238ded7667e9a6e0c51a9b8f12b27138bdf702347b3ceba8650098e0
SSDEEP 24576:MD3FHshBIYQgAe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MDVHeBIAAeLNiXicJFFRGNzj3
TLSH
T13B75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1308-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1308-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1308-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1308-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1308-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2372-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2372-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2372-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2876-519-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-98-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2876-517-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2876-92-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2876-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3028-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3028-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3028-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3028-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3428-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3428-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3428-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3428-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3428-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3448-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3448-116-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3448-118-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3448-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3544-87-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3544-81-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3544-82-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/3544-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3676-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3676-18-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3676-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3676-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4164-69-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4164-77-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4164-298-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4164-71-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4176-506-0x00000272E08D0000-0x00000272E0B18000-memory.dmp

Download

memory/4804-59-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4804-283-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4804-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4804-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5416-336-0x0000012100FC0000-0x0000012100FE0000-memory.dmp

Download

memory/5416-370-0x0000012113AE0000-0x0000012113B00000-memory.dmp

Download

memory/5416-324-0x0000012169A30000-0x0000012169B30000-memory.dmp

Download

memory/5416-346-0x00000121036A0000-0x00000121036C0000-memory.dmp

Download

memory/5416-337-0x0000012113700000-0x0000012113800000-memory.dmp

Download

memory/5604-9-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5604-15-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5604-7-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5604-13-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5604-1-0x0000000002190000-0x00000000021F0000-memory.dmp

Download

memory/5604-0-0x0000000140000000-0x000000014027E000-memory.dmp

Download

memory/5704-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5704-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5704-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5704-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5704-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5704-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download