72b361111ad755dc9e969e964897b5bbd9edb1c325997f6aca48e04d6250ee12

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_60d07ca1f21e188078ff8bb1d8942758_icedid_njrat_ryuk.exe
Size 963KB
Sample260709-r6lfvsct8n
SHA256 72b361111ad755dc9e969e964897b5bbd9edb1c325997f6aca48e04d6250ee12
MD5 60d07ca1f21e188078ff8bb1d8942758
SHA1 e3ba38a4e7fb2800acc1c524c71ed8eb6ecc0990
SHA512 e49236c8c8eed66a38b9435d684af625e30e0a9e91246712f7c7fa23a1d7940d6ea05bf6b319f9fac3aea6bd7466cd29b73252ddd1638a5e765f756cd205f79d
SSDEEP 24576:JHLBUTvfIB7weDWJhTXnP+xZovJrchBGdSmt:JHLBUbQB7weDWPLnEOxrtSQ
TLSH
T1C7250155FAA400F9EDAB813CC5268A17D3B2B45D1364E7EF03A84A661F537E24E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 16 IoCs

pid	Process
2716	alg.exe
3444	elevation_service.exe
2444	elevation_service.exe
2504	maintenanceservice.exe
1788	OSE.EXE
3328	GameInputSvc.exe
4288	GameInputSvc.exe
2448	msdtc.exe
4112	PerceptionSimulationService.exe
4660	perfhost.exe
5648	ReFsDedupSvc.exe
4308	locator.exe
4580	SensorDataService.exe
808	snmptrap.exe
3484	ssh-agent.exe
2128	TieringEngineService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_60d07ca1f21e188078ff8bb1d8942758_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_60d07ca1f21e188078ff8bb1d8942758_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\45bbc80b84defa61.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{0B3085DB-F75A-4576-BB64-DBDBF2B69AB8}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{878FF625-53C9-43D6-845F-321839BAC240}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4080	explorer.exe
4080	explorer.exe
4288	GameInputSvc.exe
4288	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5808	2026-07-09_60d07ca1f21e188078ff8bb1d8942758_icedid_njrat_ryuk.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeShutdownPrivilege	4080	explorer.exe
Token: SeCreatePagefilePrivilege	4080	explorer.exe
Token: SeDebugPrivilege	2716	alg.exe
Token: SeDebugPrivilege	2716	alg.exe
Token: SeTakeOwnershipPrivilege	3444	elevation_service.exe
Token: SeTcbPrivilege	3328	GameInputSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2128	TieringEngineService.exe
Token: SeManageVolumePrivilege	2128	TieringEngineService.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3712	sihost.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe
4080	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
576	StartMenuExperienceHost.exe
352	SearchHost.exe
4080	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 4080	3712	sihost.exe	98
PID 3328 wrote to memory of 4288	3328	GameInputSvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-09_60d07ca1f21e188078ff8bb1d8942758_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_60d07ca1f21e188078ff8bb1d8942758_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2504

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1788

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4080

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:352

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2448

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4580

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:808

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4808

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5760

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3144

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2400

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 102bff2342159004d2667b27735a06ff0cb1f282c91518e2f5a87445fd12085a
MD5 c08fbb141683527d19e22a359b3605ba
SHA1 c265fd62ce12fc394bf18cd90810ea23c4d7c140
SHA512 cdffd5f292e2367764ed4148ad4dadc11317bbebe8df8e0e272ee89c55c7003edba0688cf13cf1f6c4db3751612139dadf5a06ef9135a3b2b2d603bf2310cf7d
SSDEEP 49152:Ub+632BuPkFKRrdE6oh7stBhuXjfS4LWxnEpQB7weDWPLnEOxrtSQ:O3q6gjBpQB7weILHxxSQ
TLSH
T116D59D03F29900E9E06AD178D7469533EAA2BC890B34B6DF0780B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 01d7f1c2ef6b55b25bfd1c6cda66772d671990d7d9b9d8729687612625731a86
MD5 8d4c52a03253890c9fb3424d1d7106de
SHA1 d8963515904c4087ae796c8906003aac1b9496a2
SHA512 5bf14f5148ae7377f91f699a84ecad459639addc94a0762d2ec246fc80c71ac2716cacc00658f081bb5bb812e2ea0eb80bf0dded27571a3ca18ede25313607b6
SSDEEP 24576:OXYh5tczAQfIB7weDWJhTXnP+xZovJrchBGdSmt:xtclQB7weDWPLnEOxrtSQ
TLSH
T176050234B7A008FAEDA7823DC9618502E773B85143A4E79B03E099761F637D94E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 4d317af3e9e5ff6d70ef1f38b08e5eed21826127609ead353aca3103c0ac7144
MD5 e44f96279c1ae47fd1245975d17bbb5e
SHA1 d24bd9e6f842687196ef07c99142a3cb0ac5f198
SHA512 a3d971982a92128c14014d3bda08f09b27f52f605f6aabdf4adbb0df17638aee8cea7f7838bcdbf37e16d2aa1a6969c3c3c303cb94ecb3a1f1307f7be91760cc
SSDEEP 24576:uwuuOWLHfIB7weDWJhTXnP+xZovJrchBGdSmt:uwVOgHQB7weDWPLnEOxrtSQ
TLSH
T1F1050156BAA40CFAE9A7423D8207C536F7F2B8013665DB1F07A0C6676F63351AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffbd19975ef974ccff82851dad6ce9e23fbccc3efd587aed8046376113eb25d2
MD5 9b04c7ec8fc6bfbaac3895030a64cd11
SHA1 b25c13b5069023dbcb6fe7297e46ee4def457c54
SHA512 f4c448c66386c9ba1b6081203f0010cbfe9a4ac2a52ffd5da5cb976a3e6f90ffa2e428e8b49445c8383073a219892c39d35648180d27dd158acf9898cc927f47
SSDEEP 49152:5B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl9QB7weDWPLnEOxrtSQ:vu6JmTxd2d9QB7weILHxxSQ
TLSH
T10CD59D13F5D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 3be679c05d66b68094c3de4b2941c91962f7c7908b397502668ea8cc3b111824
MD5 6dc420f318e5e6e5adf852d939ed7b13
SHA1 3df15a48b5e8d1eb25cb0baf707daeb3dd6defca
SHA512 c5bc34210f10981c2c59cc355b3de85b011ca58a9e3a37c85a9510c202e4db73dcd28a483c5e1876a3751d9bd04e5b788f73d563ecff054335814e1a324a26ff
SSDEEP 12288:Ri76+nA1fIks7wgtDWJhTXntF6j/pZob1Fbdrzsjz/3hKEL4btdSmt:86HfIB7weDWJhTXnP+xZovJrchBGdSmt
TLSH
T171D42372ED2418B7EDEE163D430C590767FEF45072D815BB298216F23AE2F82C5A425E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ef59f839816f3bd5a0924166a307adc2bafa6210151cfb9420e00cc0d5f3dbf
MD5 bcd9cb66e238aefcef3600a44217a9ba
SHA1 27d9330cfb1ab11068a1c3b5e064975be114a6f2
SHA512 3795c947e98170f2941e25f93c457056c39fc98b048f0cbe4eef0601548d4e2136755879302592c9633548329c7facc97043af17ff1d379bf235c8aebe3c9d79
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYlfIB7weDWJhTXnP+xZovJrchBGdSmt:hgb4mBIBhGFeQB7weDWPLnEOxrtSQ
TLSH
T18D65AE1E22E802F5E4FAD2B8CDAA4417D6B278161331D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 71b31a2eb986940521f700da4700aca3c2c3726ce4e5b9bf3f811069930386e4
MD5 47db0e0d765d7f9e7f7d1920cda9a7c4
SHA1 6644ba31b09e52d169a9ca2f63195d446cb015d4
SHA512 92e1b6ef715fdccb3433576b1c051aa738db0cb94d3f6e99ae9971222903e409900cad99da365bd0b661463c384c951e2a00c809efd698eb79b7ac97404475bd
SSDEEP 12288:FUGlnA1fIks7wgtDWJhTXntF6j/pZob1Fbdrzsjz/3hKEL4btdSmt:eGGfIB7weDWJhTXnP+xZovJrchBGdSmt
TLSH
T16DE42335FC7034FACDBA823E42185947BAF9B450739826FF09C255726FD1AE18278D98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 25bdcb026126da51536c45a7a2847747d96c27e6b5954c19243e4c96c4603d44
MD5 206318e8a6699cf42782b81e9668dd1b
SHA1 2142b6b3fa896298a3acb9e4b5efdebc9e4b48fb
SHA512 e7f00c7a3dce67922eab5f4b6b5a55cc1f61f3024823f2e14c9b16e7e313731a576a04b8579d5966f1b0a31ca352ffe77ba9fc984eb955d0e06badc211459814
SSDEEP 12288:U9NYnA1fIks7wgtDWJhTXntF6j/pZob1Fbdrzsjz/3hKEL4btdSmt:U9zfIB7weDWJhTXnP+xZovJrchBGdSmt
TLSH
T186D42372EC2015FBDEDA563E42091D0757EDF40173D92AF729C215B22AC2ED381B91AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3bb5fce05a3bd5306deab69b45158850be400b1f16e5b23d7def699292563fd9
MD5 aea2d07af8711130cf3126a7701e047f
SHA1 8c6e62138314c757e7a7f8f24972414481657a7b
SHA512 1d1681998876d1f9afb02d543813d01dbb60658bc632d07ef27bcd115c892dbc49d5ddaffff2e235aaa73bacb760a491476c2071d5b400da69d71a3151c38d97
SSDEEP 24576:oLp8t8FpJqH1Mzria7/mLfIB7weDWJhTXnP+xZovJrchBGdSmt:eO+FPqVra7/4QB7weDWPLnEOxrtSQ
TLSH
T16735F161BAE001F1D8BBD13C8A464663F6B2B4151364EFDF07988B611F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 9b94adcc49478661bae05c82ebcd28a8c7ab512e149fc1045779a63bd5c0cca6
MD5 1cd5aa21fa8eee9b4a99e43275c5a99a
SHA1 d6eff6b5e6c4bfb5e53e308d7ff3fd7b4bee73c8
SHA512 371295b7982cb83726bb4f60b2c4abef557108a52533b594f14eed8399b9c1fdc47e6d034d20c5bf37e94103121293b45c01b7668ac2df9468683806741d5ff8
SSDEEP 24576:iPUr+NQdfIB7weDWJhTXnP+xZovJrchBGdSmt:iJQdQB7weDWPLnEOxrtSQ
TLSH
T17905F22F66AC18F5EA7AE13D86464709F7B1B452135292DF02D1817E1F63ED8AC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 2043d167d974d98b3e24ff0e7a889587409152723644351712ae4d3e89a21bca
MD5 12bf475aca22f4c1f78f2a1dbd427187
SHA1 2ba2d8ad9d6ac474e4d0446719ed5b363d725f20
SHA512 1e31788315057b3cbe6ce625c50cf792bb097926bfd071455484676c1e4173ed02d32d54b0e899af9864391cf0e89cc1dd7bee5c14cf08675a9f8afba50e22de
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHQB7weDWPLnEOxrth:lG05lO43b6QB7weILHxxSQ
TLSH
T1FED5C06A62FC11F9D1BBD17CCA864A0BEBB23415033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5e38a891c124e3155be463488d8d52349a257252767d01b1ab258623adeb2a91
MD5 90ae0ff5e6fe9b470a011cd26c31779d
SHA1 894c0261a30ade7a9b1384ee94382504ba819458
SHA512 9219487595df0617cdb1aa0bc5ebdee57ef8fa7581142a4fb22cd796e14af54344d6877fd63e78db7362de94640a6f6cfdb961eb24ee09f898ba6bce8cd16ea0
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkmfIB7weDWJhTXnP+xZovJrchBGdSmt:1Nc/zEOVHFVQB7weDWPLnEOxrtSQ
TLSH
T1B8858C2663E901E4F5BBE1BE89379546FAB17865133486CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 241ba43688c933c254e90946c44f57d779400b936f3be25755d3ff5e29733b32
MD5 dce02b7f4412dd4333d71f61340b8525
SHA1 e4ddd7b88487ae15c26ea7ca9daec27c61d5b818
SHA512 98c06dfb7b9c1147d7ded40c8ce7492ecafb6568cd7201de0255ffa6af38a8a773410600d09ab7999a78ca2ac61dd2044226d3ecbb5615c3c7de5466c6f83b03
SSDEEP 24576:YJnJPbzB4StfIB7weDWJhTXnP+xZovJrchBGdSmt:YJnJv6StQB7weDWPLnEOxrtSQ
TLSH
T17215E03DD2A810E9D8B7C2B8811A1B5AFF71386D2B2569C719B4D4313F42FD0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2fa5a00286d68dd33b89e7e5595370b6e12c12f603e296348cd6e3fc11b9f22b
MD5 99e045240038de648122ceb7bb7f03dc
SHA1 7d80315b3944d8d3db3abc9210adf349101de086
SHA512 481f14be3b1aaa365cdaf7eabaa5e3f6851e26f6a576597066f7f6df8b0fd04061aafb96004ee8022ee64f863c8e670a7f3cb928ceb0be2ba8982199caf27e9d
SSDEEP 49152:GCLHGeeV5ijCmlDWDkTQB7weDWPLnEOxrtSQ:tBQB7weILHxxSQ
TLSH
T1DFA56B05E7EA4184E8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 bfacf8bf58ddf0277622a62da228c1495c44bf0970189f87b9538bbb38628d7c
MD5 94b036574cdeafd4ff69bc1bdaf00ef2
SHA1 c8b24527b411652374b534dec7eaf222f93f31ef
SHA512 10a3a9aa9a2cf683f2ebf7e72f1ee05904f1cbfb2435148216c478fbdd943e0809174222ea9e1212ff345eccb80040bd1035519d1542391ce095fde51ba529f2
SSDEEP 24576:76DIdfIB7weDWJhTXnP+xZovJrchBGdSmt:76DIdQB7weDWPLnEOxrtSQ
TLSH
T15705016DB77A10F6D1ABD03E82420502D2F2F07193561AEF0AD485BA5FE3ED9B53CA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 1994b6230a19dd971241385e30545fc640950d4571424b930aad390b1adee84f
MD5 96a295f81bafeb86c72955b6cccff09b
SHA1 feaf83ea589b159b0c6da27f9e8f0d25349b0998
SHA512 145d97e973addd0e0a43d566f47dc5faa8de57efbabc95bde04120c64aff7e18216ae4e8dfb09117faa8032c68998f47d31872bef286a9bc3936b15ea2341510
SSDEEP 12288:6G6ky3nA1fIks7wgtDWJhTXntF6j/pZob1Fbdrzsjz/3hKEL4btdSmt:TtyEfIB7weDWJhTXnP+xZovJrchBGdSQ
TLSH
T16AF42211EB6420F6EEFA023C872246529FB9FC10679517EF15C1A67A3FB2BD1847071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 06294d1271530348f48c5f19b50d949290a077cfdd505180672bc4022f9bef2e
MD5 f1b0c2a851bfb6a2fa93f7daa7329797
SHA1 f89356329c0250529d896a909675ccfbce5d680c
SHA512 4db26c8b9ffd9ee8139b7913f94db09319b6367736f3ea9515478c9c9f7394de2de658fb0956c17e14a393cbfad64c4a6ac8956ff35138410fd0554afcddaac4
SSDEEP 12288:dBhnA1fIks7wgtDWJhTXntF6j/pZob1Fbdrzsjz/3hKEL4btdSmt:zafIB7weDWJhTXnP+xZovJrchBGdSmt
TLSH
T109D42271ED2024BBCDDA563E42081E4792FDF06073D92AFF29C215B26BD2AC381B4959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 4c56442a7063ee52273ccfc711deca400a6d9698274513f6c92fac210a9e89fc
MD5 ad61d5fa553ef5b94d4273b701e04627
SHA1 69fcc933f5ae93d767b7861a89ceb076c9e3c7b2
SHA512 896135cffee76a1670472dfb27f63b9109265c8bcdbcfd8f1b7f7425a87c2b7c1bcf5241071244b12a6085d1948f6e8518969ad7e8fc955e32afb5de04459e88
SSDEEP 24576:xxgiLoTfaidZofIB7weDWJhTXnP+xZovJrchBGdSmt:3gBTrZoQB7weDWPLnEOxrtSQ
TLSH
T10C559D1DB7E905DAE2B2D239D9221493D633B4315372D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 1ef83b8f35d00378fe7f80fe64c8014aa6f2559220e70def36a27a410d437aaf
MD5 42b404541c2d0ddf126aa0b567b86895
SHA1 3160f13d8c833423510b16128af0d9ab4d18bd63
SHA512 e4e9e4a3b1185bcbd3d496846acacf67f7a8954bcc40e1243ff65ce2d0e3dd0e43749328b0e2c2a1eca4183d4a0438918432324ea7dca5e264941b00997bf1fb
SSDEEP 24576:ErcmRDfIB7weDWJhTXnP+xZovJrchBGdSmt:+cmRDQB7weDWPLnEOxrtSQ
TLSH
T18605015EF66A00F6D5BB823C89054606F7B3B030235227DF02D1877A5E97AEA7D38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f6ddbd37cc9411b70fc6e5ffccfb056b2be779bee830565bfb2549e839571df0
MD5 bba439cc421b5545a3486b8e15c7b03f
SHA1 d1cb43b6061ba83d1185e3e65a237588ee790b96
SHA512 bde7a2d5bdf7e04e0937206e10fcf72f67b419c034158f2ed97728c241e98ba2e18d8c96956df3e9bb3a617e578e28d1a8a05f934855b6f17c0daa820cbd1b93
SSDEEP 49152:EDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3aQB7weDWPLnEOxrtSQ:h3Upow8sBrQB7weILHxxSQ
TLSH
T16AA58C3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-91-0x0000019398980000-0x0000019398A80000-memory.dmp

Download

memory/352-101-0x0000019383180000-0x00000193831A0000-memory.dmp

Download

memory/352-102-0x00000193835C0000-0x00000193836C0000-memory.dmp

Download

memory/352-113-0x0000019383560000-0x0000019383580000-memory.dmp

Download

memory/352-136-0x0000019383960000-0x0000019383980000-memory.dmp

Download

memory/576-263-0x00000226073C0000-0x00000226077F4000-memory.dmp

Download

memory/808-512-0x000001314CDC0000-0x000001314CE26000-memory.dmp

Download

memory/808-513-0x000001314CDC0000-0x000001314CE26000-memory.dmp

Download

memory/808-511-0x00007FF719AC0000-0x00007FF719B74000-memory.dmp

Download

memory/1788-56-0x0000022524D70000-0x0000022524DD6000-memory.dmp

Download

memory/1788-57-0x0000022524D70000-0x0000022524DD6000-memory.dmp

Download

memory/1788-55-0x0000022524C00000-0x0000022524D70000-memory.dmp

Download

memory/2128-531-0x000001DF0AB10000-0x000001DF0AB76000-memory.dmp

Download

memory/2128-532-0x000001DF0AB10000-0x000001DF0AB76000-memory.dmp

Download

memory/2128-530-0x00007FF754230000-0x00007FF7543C5000-memory.dmp

Download

memory/2400-574-0x00007FF7959B0000-0x00007FF795EB7000-memory.dmp

Download

memory/2400-567-0x0000020801B80000-0x0000020801BE6000-memory.dmp

Download

memory/2400-569-0x0000020801B80000-0x0000020801BE6000-memory.dmp

Download

memory/2444-34-0x0000023503360000-0x00000235034D0000-memory.dmp

Download

memory/2444-37-0x00000235035F0000-0x0000023503656000-memory.dmp

Download

memory/2444-36-0x00000235035F0000-0x0000023503656000-memory.dmp

Download

memory/2444-35-0x00000235035F0000-0x0000023503656000-memory.dmp

Download

memory/2448-529-0x00007FF636620000-0x00007FF63673A000-memory.dmp

Download

memory/2448-451-0x000002B69A380000-0x000002B69A3E6000-memory.dmp

Download

memory/2448-452-0x000002B69A380000-0x000002B69A3E6000-memory.dmp

Download

memory/2448-447-0x00007FF636620000-0x00007FF63673A000-memory.dmp

Download

memory/2504-52-0x00007FF63A600000-0x00007FF63A768000-memory.dmp

Download

memory/2504-45-0x000001AC2B610000-0x000001AC2B676000-memory.dmp

Download

memory/2504-50-0x000001AC2B610000-0x000001AC2B676000-memory.dmp

Download

memory/2504-44-0x000001AC2B610000-0x000001AC2B676000-memory.dmp

Download

memory/2504-43-0x00007FF63A600000-0x00007FF63A768000-memory.dmp

Download

memory/2716-62-0x00007FF7BD120000-0x00007FF7BD243000-memory.dmp

Download

memory/2716-12-0x0000028D773F0000-0x0000028D77456000-memory.dmp

Download

memory/2716-13-0x0000028D773F0000-0x0000028D77456000-memory.dmp

Download

memory/2716-14-0x0000028D773F0000-0x0000028D77456000-memory.dmp

Download

memory/2716-11-0x00007FF7BD120000-0x00007FF7BD243000-memory.dmp

Download

memory/3144-561-0x000002C1306F0000-0x000002C130756000-memory.dmp

Download

memory/3144-560-0x00007FF7ABA80000-0x00007FF7ABF51000-memory.dmp

Download

memory/3144-559-0x000002C1306F0000-0x000002C130756000-memory.dmp

Download

memory/3328-434-0x0000029C2A490000-0x0000029C2A4F6000-memory.dmp

Download

memory/3328-435-0x0000029C2A490000-0x0000029C2A4F6000-memory.dmp

Download

memory/3328-433-0x00007FF7B4F30000-0x00007FF7B4FF9000-memory.dmp

Download

memory/3328-510-0x00007FF7B4F30000-0x00007FF7B4FF9000-memory.dmp

Download

memory/3444-25-0x00000231997E0000-0x0000023199950000-memory.dmp

Download

memory/3444-26-0x0000023199AC0000-0x0000023199B26000-memory.dmp

Download

memory/3444-28-0x0000023199AC0000-0x0000023199B26000-memory.dmp

Download

memory/3444-27-0x0000023199AC0000-0x0000023199B26000-memory.dmp

Download

memory/3484-523-0x000001949C170000-0x000001949C1D6000-memory.dmp

Download

memory/3484-522-0x000001949C170000-0x000001949C1D6000-memory.dmp

Download

memory/3484-521-0x00007FF74E3D0000-0x00007FF74E673000-memory.dmp

Download

memory/4112-465-0x0000022921020000-0x0000022921086000-memory.dmp

Download

memory/4112-538-0x00007FF782B10000-0x00007FF782C5A000-memory.dmp

Download

memory/4112-464-0x0000022921020000-0x0000022921086000-memory.dmp

Download

memory/4112-462-0x00007FF782B10000-0x00007FF782C5A000-memory.dmp

Download

memory/4288-446-0x0000021DCD090000-0x0000021DCD0F6000-memory.dmp

Download

memory/4288-442-0x00007FF7B4F30000-0x00007FF7B4FF9000-memory.dmp

Download

memory/4288-520-0x00007FF7B4F30000-0x00007FF7B4FF9000-memory.dmp

Download

memory/4288-444-0x0000021DCD090000-0x0000021DCD0F6000-memory.dmp

Download

memory/4308-575-0x00007FF7E4870000-0x00007FF7E491E000-memory.dmp

Download

memory/4308-491-0x00007FF7E4870000-0x00007FF7E491E000-memory.dmp

Download

memory/4308-492-0x000001C997E20000-0x000001C997E86000-memory.dmp

Download

memory/4308-493-0x000001C997E20000-0x000001C997E86000-memory.dmp

Download

memory/4580-502-0x0000023ED18C0000-0x0000023ED1926000-memory.dmp

Download

memory/4580-500-0x00007FF7507D0000-0x00007FF750BE7000-memory.dmp

Download

memory/4580-501-0x0000023ED18C0000-0x0000023ED1926000-memory.dmp

Download

memory/4580-584-0x00007FF7507D0000-0x00007FF750BE7000-memory.dmp

Download

memory/4660-472-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/4660-477-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/4660-551-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4660-471-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4740-585-0x00007FF654C00000-0x00007FF654D2F000-memory.dmp

Download

memory/4740-580-0x000001F62F0B0000-0x000001F62F116000-memory.dmp

Download

memory/4740-579-0x000001F62F0B0000-0x000001F62F116000-memory.dmp

Download

memory/4808-539-0x000001B3E8BA0000-0x000001B3E8C06000-memory.dmp

Download

memory/4808-545-0x000001B3E8BA0000-0x000001B3E8C06000-memory.dmp

Download

memory/4808-547-0x00007FF78C0D0000-0x00007FF78C3F1000-memory.dmp

Download

memory/4808-540-0x00007FF78C0D0000-0x00007FF78C3F1000-memory.dmp

Download

memory/4808-541-0x000001B3E8BA0000-0x000001B3E8C06000-memory.dmp

Download

memory/5648-484-0x00007FF6A3790000-0x00007FF6A3ED4000-memory.dmp

Download

memory/5648-483-0x000001B3FC240000-0x000001B3FC2A6000-memory.dmp

Download

memory/5648-573-0x00007FF6A3790000-0x00007FF6A3ED4000-memory.dmp

Download

memory/5648-485-0x000001B3FC240000-0x000001B3FC2A6000-memory.dmp

Download

memory/5760-550-0x00000260CCDC0000-0x00000260CCE26000-memory.dmp

Download

memory/5760-556-0x00007FF62AD90000-0x00007FF62B01B000-memory.dmp

Download

memory/5760-552-0x00000260CCDC0000-0x00000260CCE26000-memory.dmp

Download

memory/5808-4-0x0000015DAF4F0000-0x0000015DAF556000-memory.dmp

Download

memory/5808-2-0x0000015DAF4F0000-0x0000015DAF556000-memory.dmp

Download

memory/5808-0-0x00007FF66D640000-0x00007FF66D82F000-memory.dmp

Download

memory/5808-19-0x0000015DAF4F0000-0x0000015DAF556000-memory.dmp

Download

memory/5808-1-0x0000015DAF4F0000-0x0000015DAF556000-memory.dmp

Download

memory/5808-22-0x00007FF66D640000-0x00007FF66D82F000-memory.dmp

Download