f181185ee46a1f783bbe27c5070498fc8429448d3add93713d24300348925939

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
Size 1.6MB
Sample260716-b2hamsaw2l
SHA256 f181185ee46a1f783bbe27c5070498fc8429448d3add93713d24300348925939
MD5 9c3f268a6c7b762c34cc52020a7f0859
SHA1 a786c2f48509afdebec09ed2c421ccbae308cdf3
SHA512 233973eb85df1fd0fa653793c1cc8ed95fa3973db0d7e5d410880103e1aedf664ccaa14538a49c9387bf4898e74770f47a0e00ad80db52725144e8f28f35a3ec
SSDEEP 24576:9sWBaeHKy4H068QSQ6X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9PBRKn6XLNiXicJFFRGNzj3
TLSH
T17975229172C1C1B0E9B914394029C9746A5CFD394F61AEF76380393F6F746C29A39E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5368	elevation_service.exe
5428	elevation_service.exe
4072	maintenanceservice.exe
3060	OSE.EXE
4116	PerceptionSimulationService.exe
2392	perfhost.exe
4388	ReFsDedupSvc.exe
1256	SensorDataService.exe
3832	ssh-agent.exe
4884	AgentService.exe
3132	SearchIndexer.exe
3844	240746031.exe
1304	Adobe Updater.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\UPDATER ADB = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Updater.exe"	240746031.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\UPDATER ADB = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Updater.exe"	Adobe Updater.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	Adobe Updater.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Y:	Adobe Updater.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\V:	Adobe Updater.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\S:	Adobe Updater.exe
File opened (read-only)	\??\X:	Adobe Updater.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\P:	Adobe Updater.exe
File opened (read-only)	\??\J:	Adobe Updater.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	Adobe Updater.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\A:	Adobe Updater.exe
File opened (read-only)	\??\B:	Adobe Updater.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\I:	Adobe Updater.exe
File opened (read-only)	\??\K:	Adobe Updater.exe
File opened (read-only)	\??\U:	Adobe Updater.exe
File opened (read-only)	\??\Z:	Adobe Updater.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	Adobe Updater.exe
File opened (read-only)	\??\Q:	Adobe Updater.exe
File opened (read-only)	\??\R:	Adobe Updater.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\N:	Adobe Updater.exe
File opened (read-only)	\??\O:	Adobe Updater.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	Adobe Updater.exe
File opened (read-only)	\??\L:	Adobe Updater.exe
File opened (read-only)	\??\M:	Adobe Updater.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f01dd1dc238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	240746031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe Updater.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043a87bd3c314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ec66f3d3c314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cd8a512c414dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066b875d0c314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3479dd0c314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe

Modifies registry class 41 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0 = 4e00310000000000f05ccb0c100054656d7000003a0009000400efbee95c2f72f05ccb0c2e00000091000000000002000000000000000000000000000000f7768a00540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0 = 5000310000000000e95c567514004c6f63616c003c0009000400efbee95c2f72f05ccb0c2e000000900000000000020000000000000000000000000000003e72b5004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0\0\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5000310000000000e95c2581100041646d696e003c0009000400efbee95c2f72f05ccb0c2e00000071000000000002000000000000000000000000000000c3d6a700410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 5600310000000000e95c2f7212004170704461746100400009000400efbee95c2f72f05ccb0c2e0000007c00000000000200000000000000000000000000000094f8d0004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 7800310000000000e95c2f721100557365727300640009000400efbe8158a93af05ccb0c2e000000880600000000010000000000000000003a0000000000c450ec0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
992	explorer.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3844	240746031.exe
3844	240746031.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
1304	Adobe Updater.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5368	elevation_service.exe
5428	elevation_service.exe
5428	elevation_service.exe
5428	elevation_service.exe
5428	elevation_service.exe
5428	elevation_service.exe
5428	elevation_service.exe
5428	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
992	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3920	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4388	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4388	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4884	AgentService.exe
Token: 33	3132	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3132	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3132	SearchIndexer.exe
Token: SeDebugPrivilege	5368	elevation_service.exe
Token: SeDebugPrivilege	5428	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
992	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
992	explorer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2304	3920	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe	96
PID 3920 wrote to memory of 3844	3920	2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe	101
PID 3844 wrote to memory of 1304	3844	240746031.exe	104
PID 3132 wrote to memory of 720	3132	SearchIndexer.exe	105
PID 3132 wrote to memory of 1080	3132	SearchIndexer.exe	106
PID 3132 wrote to memory of 1380	3132	SearchIndexer.exe	107
PID 3132 wrote to memory of 1560	3132	SearchIndexer.exe	108
PID 3132 wrote to memory of 4960	3132	SearchIndexer.exe	112
PID 3132 wrote to memory of 2832	3132	SearchIndexer.exe	113
PID 3132 wrote to memory of 5240	3132	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9c3f268a6c7b762c34cc52020a7f0859_amadey_coinminer_elex_hellokitty_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- C:\Users\Admin\AppData\Local\Temp\240746031.exe
  "C:\Users\Admin\AppData\Local\Temp\240746031.exe" C:\Users\Admin\AppData\Local\Temp\240746031_240746031.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Users\Admin\AppData\Roaming\Adobe Updater.exe
    "C:\Users\Admin\AppData\Roaming\Adobe Updater.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4072

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1256

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3832

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1560
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2832
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5240

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8cdd3eeb3975cecc83d4de98c66c7f9e34f76206d0890a225cc9979321efbc64
MD5 6e7213f56c9aa0b4a785024b5793dfde
SHA1 3792000057bcb73ce4738f95ce091740026c98cb
SHA512 5d15c649c7d5de76cd070640237a5780574a75b2fccf6fdb7980a9bc94f7028c882feac861d59111f14eb2887f629546a067e8d3efad47af7b324e9276d013f5
SSDEEP 49152:8b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnO5LNiXicJFFRGNzj3:m3q6mjBx7wRGpj3
TLSH
T15FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 61eb1a1967ac6fa95fbd71cfeabd4dc768e791d550ec10421633a1c97fd8d474
MD5 c2d2bd6dba694f59dd54d91e6aea0878
SHA1 96484cb339c0add5ade3d82d3d138d17ba68a297
SHA512 d77bae79438fdd7a796d07353570ea7c2e7c1b63bf1eceaa282e339e20159995e54312be47b86718934086c512b6c2e62f103837a59d75cd411d7cba6c3487e0
SSDEEP 24576:aXYfDtczAz5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BtcQ5LNiXicJFFRGNzj3
TLSH
T1AE75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 addd9399c5ee075e9418f2cc344cea1d3f13bd1960c1455f1fe10ee0d126081d
MD5 766ebbff38860b6bbeb5cf043eef4c59
SHA1 21f1a28e6843777a8f5be3e4985ccc47c57d5a85
SHA512 ee5f523be8f482054ec9ceec50d245296f3bcd12469848b2396fe830c3813cd7637c74562b73b9f2732842a3463b22f31cfda612e0bb787007c29e9284bdcaec
SSDEEP 24576:+0Le5ji0hmxhrMG5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+Pji0AzB5LNiXicJFFRGNzj3
TLSH
T173859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0aaa3ad12354f1124cc5728a6a6559e52b11d03949d03c0d849e5d413641b2c6
MD5 0df4b435406a7a4737095d8338f26240
SHA1 1d1c934769ba88bfae817b8108b4d855a0059e06
SHA512 b3dd3e159f89a8c6cda9c76e58e0fee6e1001148a106b847a05d1a9e30051f92fe90748b584951733a79d8e288d7b1b37074d286e6b517bbe95cc989498ccd5f
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWj6q8wyug5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:A/ezSC6vUzPv+HjyV5LNiXicJFFRGNzb
TLSH
T1A3756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ee9fbdf96f5305a97f97fcb955000356fffb4fce26719c8247834ddb12f5a8df
MD5 b1793de464d730fd28e7215409ef08e8
SHA1 1e352248bbebc3841ebc3920e95c62f9bb7af93f
SHA512 bb80166ec0a6d761ba60eead2444b664eff163ee729cafae219bda05d3b6606cd55d62ccbd4934040f71cfaffdd8deeb4e240c271159e0bf282e05dcbe352e55
SSDEEP 24576:DVbqPb88hv/l+Bv5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DVO88hXl+h5LNiXicJFFRGNzj3
TLSH
T1AA559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 db975fa61c1e56fa11a1c81865e49f43935600e22479cd47e19c6e64f177d384
MD5 d59438ca71afe0b73b605285d5759a74
SHA1 b44b4602f7eaa4ddfbc1c1fafa27b43001264261
SHA512 415de524b477de75c97b9b948f2a3f3a6b57c00fcc165cdaec5bacc6039bbf32f21669a778ea5b6b8bfd074ffef7205c1d3fac0ef3aa16d8f2023a4531d8ab45
SSDEEP 24576:HGS5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x5LNiXicJFFRGNzj3
TLSH
T1875523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3f6c32d0115bc721c2e2a3e5e2fd2ff1c913dd6bdbeed0affac4df264d49593c
MD5 4235e67b82da7177f47e9d3f9c54bad3
SHA1 fadb5ae639ac5445c3888dadb506d9086638da3d
SHA512 d14e4d889ebd711b6ac8e7c7bf67228c43dd385d7b32289a0ee7f8be66391b71d7b0cd2530c5f2cdff7be87e3cce9e9732bd62a95f56decb3947a1339fa12608
SSDEEP 24576:jJIUH5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jJIUH5LNiXicJFFRGNzj3
TLSH
T15975CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 95787683da15124d56d9a03aa12d69cddb86fc44cd4d0c6d48edacc9f9df3062
MD5 6e6acc862526511a223accfa1d621d8d
SHA1 16084096635a82a99fd823df3ee4d8fa604644e1
SHA512 4ca5f3fed9ba619786712c8094dce2c56da0aeb73ea2f7be2eb25b118331ff5facfe8eff365b400d71db682575a388007d3959e24535d742c10ff6e57cb13448
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THZ:9QvGAdlCEL8c/WRNw5Cg7wRGpj3
TLSH
T133266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 97b919361f9859e5a2a78bcb7b8b8343cd02b8d150a233ea5877fa41ae010f96
MD5 deadf5bf99b17b1536c75f7c00cb9585
SHA1 46e30a3295bad4e7fb898a189ea2791b25e70808
SHA512 6395d8ee5c1797d0516648e398b2399c95212a240871e0ac31d837e2b1f7c660463deec4964f6cbdd9fc4ee8e8335cd1641dc35e3f331a0f978b5c3971fbf8e3
SSDEEP 24576:FfewsAjy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZljyLNiXicJFFRGNzj3
TLSH
T16475E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e8701b2fbff6c258b9c7e8cc27dfa561a742f17f0466e4854f36e57db3f2dc58
MD5 4259a1a66caecc35597f7572674108bc
SHA1 8f1ee1b4945e7f2cdb90b3547c2ca747442c82cc
SHA512 62bcaae31a4228c831ffe71f40494650a5ab4d88110571cd489bb0211285a24b2b992c329947330d7afa17d87d93f2d7beac3cecdb733fb9cf46d8d06ae6eede
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHuF9:dUEtQevvqc2W1cpV20I32C9
TLSH
T1BC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f879abc7363bff44bce615e5a43d896c2560598dee8c7e5d18cf4474b00f3fe
MD5 4c7dc19ee8cccea07ed5bfdf773f8bdc
SHA1 c4ddb9d93dbef0c8bbceaf34391db26216344158
SHA512 1334a6e2cbb939a7763aa5a1acad1914f562d1b05dc22a295cec42286cef0cdda13215527c55af0ff07366ae59f457a9a4f458b27822fb3698fec827ab922543
SSDEEP 49152:bCbRquA/m2yL5zLfFiV+XenmE3/zx5LNiXicJFFRGNzj3:Eoq2Vjnmk7wRGpj3
TLSH
T182D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ee420c2731e3dc91acb1966ba0d0526dadcbac8c5c319764a3ecdac76155548a
MD5 2801ee2bd68d5b7127512c1f4bfdb7c9
SHA1 147214f69bfcc68b8a95e81e8b913c38723f5ead
SHA512 142ba7c76cb81cd0909cfe10418f5db90f48dcc4cf0b693879025e76bdd180a92fca6ced0d7b9959df7e89533938a6451877fc9104a33c99644f10b94d6b45e5
SSDEEP 24576:XAhGL6IFoiwtA5l7S53x/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XAM5Foiq5BLNiXicJFFRGNzj3
TLSH
T1CA359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ed9c1f14b5758478bed51c1fb9f807babfa3a7e800fdda715cb5a9c9a1086941
MD5 a8d5a0c6b68f86c5ef10b8966757510a
SHA1 bf69cbb4a784e6bf49ae032dbde07c75e857bcea
SHA512 2407d00d943d204379f410c219384c98d4efadf7e4c10f99153022034e228e371a44811ead7256105dc17b0c8dbea4ad110a2e99d07c36681d0b660463f9ec18
SSDEEP 24576:swuROW15/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:swSO45LNiXicJFFRGNzj3
TLSH
T14965F18632940CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 14dbcb177acd010c14812b9fc291b58153bb3fee3c8a515e5079a06856c8e6c4
MD5 4fc7117cc6c5cfcf489d0092c55e3cfd
SHA1 119c65a0d55d7a14958c41d1137c3845ff0a8cd8
SHA512 99782c163a83f84906600d1df5b12ab5129033e85bfea71ac392f34db71ca40fa3079c9039faaac69d79ab44218a3383339ff460bc3d003751c12bddb2e97ce4
SSDEEP 24576:UZuD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xLNiXicJFFRGNzj3
TLSH
T17055129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b13d143aeb55fb412e88f0e3d01d4ceffbfb66b915f0aeef5c2b5e5d6b0a3f5f
MD5 b5ba058ac9c9c9df633b9aa34d859b5a
SHA1 5ec7f3cd56680c87e7d0f7857ff6c36171e6d31f
SHA512 d0b0ded64bd845fc7ec3f69b0ff190744d50c973ed88f67e62c5c6b6decc73ad4a433c5dc985f0f40dc5eb966837f0eb98e4fb115f5df40d1cfbcedb778d5e1b
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3c7wRGpj3:BQyiKanX+PNoF9
TLSH
T10D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 30e08fde157dd281cc95ce56f63dda6f6901d23a34b9c241450c04c49f3c2388
MD5 c44f5e79786bc7d7bf3085fc3033b83f
SHA1 3014458de47c088a5bfc9df80afcb608e45bdce9
SHA512 89c39eb9cb116d5f5f56e69379f9c2683fe937d348d6801ba920f0cf3d7b8a89430bd35554b98046296dfd6108fda39ab6c1d9e59b5bc21a106b5dacd32d01a7
SSDEEP 98304:QQRQyi36YOcPDLvw2gAf+PN3c7wRGpj3:HQyiKanX+PNoF9
TLSH
T185667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0ad1da254ded1970b51c09dd6b33067f6085da61e54eb1661ad14cb68ff56bd9
MD5 c1dcc78ed15def755cbbf227f539e4aa
SHA1 f787aac918974283c676563a3812df858c34fb24
SHA512 a1fc69c53126601e9845b43bc55af8d1ac54984db81aaec5ff98ccecc9ecb4cf4c0db8de9b51817c8d606b7c50d1cfa5dd87b32152f4c2a88883034f1509c5b5
SSDEEP 49152:h68Qg55nhkeWu7PNU3/CLNiXicJFFRGNzj3:fthTRc/C7wRGpj3
TLSH
T1B6B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a76e5ee6c8c9a27d84dbf09e2a62d8e81bb7cb3941183d4cf3711a832618179d
MD5 f68da4265c596b85aae43b0038d5d2ea
SHA1 096d7011fdfa97216154af4a542da2eb7189dd5e
SHA512 18c3889585eb51eedd3ae3b94814dc8b73a4ba27984b122245d3cc576a9a84e4fb35ca5a384f11e6d77963e5e8f5ba58e4085900bde7feda6370ac44ef296d5c
SSDEEP 98304:Oy5112gYy5azzVvU69nLKnhZ/7wRGpj3:/LIHRWhtF9
TLSH
T17B167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0c4853ef651da44601e33f4b83bcca7de3893daced38feb04ed85635736a78e7
MD5 028c5c21642f69c8c4651ac0a52c3775
SHA1 a448bbf2552a8c89248ea8616395f3b0a1998c1c
SHA512 5d46c788e189200ef36791a09dd84724b30a31e527ea16e58e4568c1a1976f681e69f8a92836a1f8231d0e220171dd635b2dce857ee1e05c3b506a87358d83af
SSDEEP 49152:+B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glj5LNiXicJFFRGNzj3:su6JmIxd2dl7wRGpj3
TLSH
T190D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 155431e5ececc039f1b262ddbd419edde7ba79a34da60daded27b88602050d48
MD5 a4f085a5aed167adc5e3053783cc826b
SHA1 a86e128cd4bc0922fd21f31d0b3ad1fe874750f5
SHA512 dad30d84a32c489dd5c1d5afee68d0888eb00d4be51ddf3267a6ac10fc5ba5074c8b6e1719cd98fa9c3a2ed0eaf51397537ce72d012e83c70890c847e2a680da
SSDEEP 49152:b1hpsNoJpF1A67U44CwH7R4xQLNiXicJFFRGNzj3:bmifPqRR7wRGpj3
TLSH
T12BB5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a9d2953925e40c4b072e1e2a40666e1d92ebbd20ed5d934385200c908e8d0e75
MD5 8c294df5554c157e10c2c1ade0fd674b
SHA1 660fe0d9f2512ad94af0fcbcfdd9c1c941e7f8a9
SHA512 a65f98ed0afb8f2faade5b251f7a29f78cc5842db8456f6e008f902da86273cc77a2a142d243f7c60eac0f4345dbe45e15136408f20c33d2dde3176c50c51df1
SSDEEP 49152:VSuZQIY0Be2KkRVtOnks6NMHqDLNiXicJFFRGNzj3:75dKqi61D7wRGpj3
TLSH
T1B9C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dd855ebc02c9b2f4159531abe143c908db5bb02253a033999f962dc3ae46a315
MD5 e09fbf734e36eeec4d499a020821e5bf
SHA1 796a39ba60c3eab2b28d2dbe9d4e7d3b761c1db4
SHA512 1d1f2851caf02261e41695e04055d80266e4d0f42ae03da0690bcefc2c73d2c7397900e3ad8e4fdb73f7046ac08b5d509240514c96d595ee942e6c7910d69928
SSDEEP 49152:uhtSn8EApI0figjgiDn0AP5wkLNiXicJFFRGNzj3:vX2iWph97wRGpj3
TLSH
T1E995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b90e1b73ddf6f3ba346c8dacd446c19cdcb94d5c4b5cfd3b616feaf228c1d831
MD5 052b938cd77eb9a2e241834ee5f2fa6c
SHA1 45f6f7c5434f12f6939d2795276495c4ac08b494
SHA512 837e8ec659e7a4f072e31362e3e65141cdea92218b23bac0e9f787ecb1e1a53f5a34e7162ea54e4e3eacd47ff9ec04859ada803cb4bf7a4e131236eceaa0cd92
SSDEEP 12288:YDiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D75523D355C955B1FAFC0039C6754428F5881E2DEB5618E3E2483E1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 85d782c6dbbb2eb02e88af9e3729b8321960511b864987be99b2684c78871395
MD5 a120315af822b2c0078ef3df146961bd
SHA1 ccf164bf6a3bbe78ef5804bb7c7bc71a90be4074
SHA512 530686037b70c8e225da615758be9640b04a92ada024c0333c2430d70ac96e125f8c51ac25f6e12a978d06a22bbdb22bb236b701eb026c02367d79c7d8143715
SSDEEP 12288:p8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3558955B1EBBC003986754428F5882E2DEB5618E3E3483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 74d68fb2beb19cd1cd3e4c852dcff28484b6757036d722be7aa0b5ae9c44e542
MD5 c6596323fd2dde0a0eee8da3b7a189e4
SHA1 13771084b6b1d31dacd7d4097fb8b2228a9d5f33
SHA512 5c7b7cc5a78cf8b82294854a3758fe055ef8686e24985433fa9b461caf09f2afdd5eb63daec894d16da7212ae1e7f55d54ec21c6508f387a3cb70f66d5ad0293
SSDEEP 12288:3eiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E95523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 1cab54d7a5a63101dc8ac8c12fa8439203874a0451f56ef29b3febe0520a92eb
MD5 a7f07ea31daee717a4facb58c4caca30
SHA1 10d2b993f062b00f179b24e0b5c8ce2b944f5007
SHA512 eec7fee2daffdce913a86d826ce902c0835d584fbf14d5e97878a6104f2a17981bee10674c50dc021205c862707eeb1a826b2c01b073e5448afa4e3e3882a77f
SSDEEP 12288:kVNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T112552393168901E1EAFD8039C6764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 76d2fabdaac4b684832e1ff1adc856a57e54a00df694d561cc1a7c613080c572
MD5 6e167c289f2e2d9a20ac60e462ad9a43
SHA1 c4db27870d99794f3e381c5903ada5af7b830bb2
SHA512 387c644c2e8e4e00dd229608382259602a11d870916ff86068330376b07c0dc256d13c10ec4f0890ebdba4a97d97b184e9d90da5e35bed33fd8d4c40e52e367d
SSDEEP 12288:SViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ea38c5d16a974e387185a7c6414fb51227e4bc89772dd2dae5e64b6cb632d341
MD5 0792887454349888fd4952149fd2d9f1
SHA1 c607cc61ebc97e6fb94fb1f2c2d6ce82c38c4f6b
SHA512 8bd6d193882a630da326420f88e02ed09c54f8115b66d890e79cc1860b02fccccbc657ffc8905d4557e36ad4fc3eee665e6314514f2758ac0e33b05eee450cf1
SSDEEP 12288:6YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1825523D3558955B2EABC0039C6754428F5881E2DEB5618E3E2483D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 77e9ed7fc9414c0bd0d01bf6eff43c02c4df1a35f2fe86013e94444c46f6107c
MD5 496a45648c6d75776baac053bb31cabe
SHA1 9a08e372c3329e6727e0406b92a1fc7bb20ebc26
SHA512 f7067a285d105745aa0129b865f34f6419ccc87906e810eec6de2d6e044287c5dce3df8821a7502a19b4d15e3f4a21812ab6e065b946f2bd9a547907b83a6f1e
SSDEEP 12288:bEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1145523D3548955B1EBBC003986354428F5882E2DEB5659E3E2483D1EA27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e0c0ee78905da2679c0e7b5d86f3b7d011bd1b7def4c59ed99e311ac2dd829f8
MD5 adc8936e08b1d65b869d1a07c16f2a89
SHA1 b19ff5ab63db026421ed4b63c7228a6b54432ca5
SHA512 251a4652f6170ad225dfdc0a8fcc47b1067332f3a2395c9a8c16c4792e8f367ac72f0d1cf7729304dd829f75584f6fe4fde8ff6877e93570df48773fff6e444d
SSDEEP 24576:9ZM3zFVSOm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9ZM3zfaLNiXicJFFRGNzj3
TLSH
T1B7750295B39018F4ECB7813EC9258815E6B27C194B70CA5F13A4362B5F337A14D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4e36fc38b686619e6c319ec593e24446e167e28151c8e3646d543cfeaa968067
MD5 31d449ed7673c5250a7d50d85b1ff884
SHA1 ea164b289bb1ac089dd64131163077c1f3acb974
SHA512 055cb1653455fccfa1af80ebc6b1a3f33f0421d13a7ebbf69d8d65661515520ced0430a714f3877b24b0458271c034a65b64fac303a816cd692431181a0e700c
SSDEEP 12288:WHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3558955B1FBFC003986764428F5881E2DEB5658E3E2483D1EA238FEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0c85c82f4e2a5bd1f3d4a5bf261788b2f9ebc417c1d5b1a2f18099f44f6ac262
MD5 0e32c954ed2b6819bf4123016ed4858a
SHA1 7593670d8d4636c9983d4b81c58043fed99e844e
SHA512 64127a5604563458cef1817b290e6ade46e298520654303310d94553af17d3d5c9f4b958827848dfed04844f25f1789feaeb17ed51a1f601b474edbe9b4800d5
SSDEEP 12288:N7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16A5523D3558955B1FBBC003986754428F5881E2DEB5619E3E2483E1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e027cba2ac5f97742084ba077320aa9baecfce85d1fcbd744641240f67d9a0a3
MD5 7feebe18cc934b50ab7dcc9b46b0e7a0
SHA1 f0f9ed9611f9fe76d137ead143b33d1050a13371
SHA512 2831ba7c8a8527c43b2bb22b62663efa9d33bd252885d59a3cb59f31acbe0dbdff685ed8afb7e5b672d62f44df24a1edd1d58231d48ba6b21450bfdf0e73fbc7
SSDEEP 24576:8zyi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:89LNiXicJFFRGNzj3
TLSH
T160650147629530F9E17A8139C9620911F3B17C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0363fee6cd9652e356fac66694841740ae119457dcef2c811d583eab5680d506
MD5 f827aeb99356b4b810c3b772612c91f4
SHA1 a58f2296b9246d363f2f88959f5075626bd423dd
SHA512 7093465b8897c3b1242d520ef53d6146baa1d740fa0f7ed5cf80ff05bb29605ff1c95ae75c51599a26d0450f2f5ca834b6f8396fc191e458b9974a120e632c72
SSDEEP 12288:xHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3558955B1FBFC003986764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ea3e95b4544e886ae48bc8ef3118bfc1cd11645a618d257dfc85fba5a3ead935
MD5 919dcd2e00d4b07f55545766f0f30a68
SHA1 1cc3ff1d330b37361f0dbb3b2eb90ff8b301d1da
SHA512 d64b2fbf3ae327b9299e10d106c6072c34f47ca246061fbcdc9d7bbcafbe7145f615f71b217e395c306411ef3aeca42f6356eb629f2f20deb4700de83537e7bb
SSDEEP 12288:tHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T15D5523D3548955B1FAFC003986764428F5881E2DEB5619E3E2483D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 fa350ef02cbb945bfb4ce4f41242b1761660efb7a70036da990e46753fb4d121
MD5 4f247f85970c1ed6c5f300ee55008fdc
SHA1 97dcceaf6018fc8b983048e0fa2c5f667d0184d2
SHA512 7c5c1eeed7ed5224b5b062c416c4f0afeba11094445159dbd78f67d34871b701829c804ddefd4aedfd55b8c8cb7fb8a54788c23b1a5ffd0d0509aa8446958259
SSDEEP 24576:Nzyi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:N9LNiXicJFFRGNzj3
TLSH
T1A3650147629530F9E17A8139C9620911F3B17C3647208AEF53641B7A2F37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 e792d82f4c8d7ada29f1581bcded5e843f9aedd72751aaa29f0e93d547320dea
MD5 df959844b897f98794d7e73f6b73f6c2
SHA1 d933f3fcfdadfa85a940a15fd2b6c82fc4a90023
SHA512 9cbd6362c52da4de8daec041346991a23ca6386fb0bbc13e4a5f861e5d1f704901672c216baa5e97717c0e2a5262a4520fbacf4b6e6df1606f22ca1922e1fa3f
SSDEEP 24576:oT8aLl3z0zD4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oT7LljlLNiXicJFFRGNzj3
TLSH
T1A47502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 df15a4e4daca19c00ccd88f394641291baa2d0cbeb64aed86e8d1e9f1962658b
MD5 da212fad5e0af3a331606a3c22e74103
SHA1 0a9b752c26b3aa0becf20d39ab3cb1f2c4a23fcd
SHA512 2b2848c35faf8640b41466467afa2c9e27d6d23a75160137f4c09008382b3fa4c367eb419e2d32f2bcec02c83142095b16d6cb075c6d46f6dc73179e7e76a09d
SSDEEP 24576:b3rd9CHKy7GZ8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7rd9CHKyaaLNiXicJFFRGNzj3
TLSH
T1DE85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7c7a20f28a69b696b3a69d31dde6157c246ea8c6a2e1dc461fa964bf77d4a448
MD5 09195bc5033019c02ffcdce958d5c1a6
SHA1 b7ddfb24954ad9214237fd57558b532078f21ad8
SHA512 ccf00399b1d22bf83641630d6123490d15f8f5c71d8cc4113732debdfd1352338f1d893e32df50ae79c58885ca38f654af5d0606476b75b281f1a0c8f01c0cfb
SSDEEP 12288:D+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9904f333a4371ad7f8f7179e5b2db41e2c8d8b6fb043c79d2a2fe6868633fd55
MD5 ccd2e8dcd12fae1c4f06de8b6002d651
SHA1 323e65d19c2ead7eecf9f1af6023e99785c465fe
SHA512 8349ff4b41f8561b0c1ecdd67d2448cd0bfd47b7a9399db403ed9d2eb68872674eea460dabc680fad355184a2b19bdeb4be561efcea244551813ebd653aef566
SSDEEP 12288:TQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:TC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19C5523D2558955B1FABC003986764428F5881E2DDB6619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7a302b698166e3c3d6393421f3de3dbb0b6058d2a5bff9da899623047f1eb2a7
MD5 0fa04605d1b969d16c2a300709af7e2e
SHA1 7dad4c0476f9a3fece02b855fecea48d5f0a2297
SHA512 2814dc2ee8262c65509fdc1ed096a206564a0501390181bfd25d571d684e49d73b3143049dcb26e601662bf8d755974a6ff09cf66ababc50cefaf766e1104201
SSDEEP 12288:JBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1925523D3548955B1EAFC003986754428F5882E2DEB5658E3E2483D1EA27CFEB8F3C466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5fcc68805c82e27b98c533b852ff948b4e75420db3661ea62636e904e51b207a
MD5 038d1ac2ebdd6159fad6e5e345b11444
SHA1 c0b37bb51d7064186c12c5ca08f1f9a54fdb5ba6
SHA512 102a4cd4c243a5e931fa08483a4255f3cff31cfb552b93db6a8e02a5d3c392300b30775f1792b121bcb1138a24cdfa7cdc98bf9a8ff814775925f7bead701c18
SSDEEP 24576:xfwvzk9RX6wkyAIy5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wMnYIy5LNiXicJFFRGNzj3
TLSH
T11985D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3c02aa1cb44ddda2bc205ac6cf07f49a160cc41e32e825a8994d1e3a76b02268
MD5 dc4b98af188aae0ac36ea6695dd248b6
SHA1 d04dc57b852a8c97d16a5c61bdc09b3101bd5927
SHA512 0cd1233ec564e70efe451c47c34de2d68e43ac2d7ac0f540fa325335150687e443ec474c8802ae96e66e47224c23bcb5271f3c521c20db29731feb356cfbd9a5
SSDEEP 49152:YYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0T5LNiXicJFFRI:XySzPN7wRGpj3
TLSH
T1F6066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 afe31f6de90d7474a15a731e9cbb8ca5ad69381f977454a995372aaa240f09cb
MD5 cae30d3e89837a41c14d0722bfa974f1
SHA1 f4daa781c23c6777bcfdbfd76703e00d1eb3d43e
SHA512 02d582297d8bb2d005ea4103eee5e4f9afa3b29647afb5b2abdb4ab04c03d9f4442ca9af8f60547d882c91425f3826c83e5c1cf904e7136fe1c486e1da01bbe6
SSDEEP 24576:R47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYt5/TwSfVcYG3K/cJHlnFR+IGNe8j3w:R47JUQjqirIhCnDHUPfF/j5LNiXicJFc
TLSH
T1F865AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 2ffca0ed2dc288a9df86d1fbb8efbb71a3062b292e280f19e81b3f8592988adb
MD5 7efe256a4cb9cc0f607297059ce6dfff
SHA1 1335d3c2fb4dbb7b51d2be659e3c29225944f93f
SHA512 9ff32a003b359bcf9d882af958f2590c88cd11f6f97bcdb6106f22aed524c984c7368f6df699654c923af63b7fb8d45aa3451101c8f86f577ed9eeba77349b58
SSDEEP 12288:Fpsf3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FF65F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB92D0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 221907d014cc5b4b1d187366fb67d7c12253bd7b79fd9a1c3ba9447b3b77b3da
MD5 14e14236ab0b6d0ac2587bf78eb8533c
SHA1 fd28e55f4067ffdeae61f69428cdaa0b90710a85
SHA512 f2dc56b7d361bb0cae7e3712c9d1bce2f2b0f1555419e1546686d6b2afc2b1631eb5bde4e5c5e22edca85c1bdd59406f698a35c6b452258f5cce6ca694df2759
SSDEEP 12288:Ujh42y5JfkXsgCwjMC1ofpJYef0GOSCoYj1:Uq2iuufpKesGXX
TLSH
T15E452910762BD75FC6A940325E77D2CCAB707D05FE455B0372C8872FC5766A8BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 c7c45947b18cc59db93450d74610054fabd33fb95e29f141da1f80cd15754665
MD5 9c41558e5690451e396068e76b503246
SHA1 cd1a1eb00e4185cfb49604321598eb57858bc652
SHA512 176136c03255d4ffee3b10901f4234ea8d0109f85884d44552e9bbb3573963cdcddb3b32f994ea9be948ce0480301764a33732b6191a2099cacdd846358b00b5
SSDEEP 6144:g6kiAPFcXaGy7KTZh8OlNIcxsIVOE2LhXMKmCia0SLP6TKDexHC7W7Kv4uJrYZ1G:yiRlv5OQnSLCuZsHPO6UcY
TLSH
T15955D8816137E39FD1F76032032AAB4DA774EC06B7096E2673C8453AD86A755A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240746031.exe

Path C:\Users\Admin\AppData\Local\Temp\240746031.exe
Size 180KB
SHA256 b8973f919a2629fb449fc692525c6cadc12d8d01b4ae624c0eb0a8481f6e15e8
MD5 c098678e0edc578db10fec71b0117764
SHA1 98eb137d96f81a15ce9f25c3bef20c293e1adaec
SHA512 9c8895ca19bc49972e5c2c17e189343c5eca4a2263c1067512b860e8c26ac561ec56d94aeb4b8af764a235bc9e893dafd69fea9c8bb59757c9efd9ff835176c2
SSDEEP 3072:tjtBrev5mbGnrbZjQ8iaWt1pl+0tovgUrhCA2kFh3d2desT3eOBSLhVIhZ7+CYpS:tjzcftQ8ipt1p9t2rcAv9EksnBsVIhZd
TLSH
T197049E2078C1D472E4B7053015F9EBB269BDBD301F6058EBA7C42B3A9E305D19639A7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\r0
Size 1.6MB
SHA256 6af5ada28752b3e17c5921494e51d880cfedf43942e6740d22f4425ec5d4bd32
MD5 6c361c9410603efddaa8cd45f9ebc329
SHA1 9944b40c9c9a25aad5c79de21e925d2cfd35744a
SHA512 c4a1dd2da2537915b706cdd6dd7b797ad191fa4ece674bb3a8e08a4d044a631e1e0dbed085b90abfc7604f89b6ac8a62beda1dca349fbaf28de988806493aa50
SSDEEP 49152:jcRJXBDH4uwJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJZ:jcRHDH4uM
TLSH
T1A775F16EE15A4D89EB44FF1C84C94BA4E8176207BA62048B35FECB852D353CEE31D61D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 9305a6f40bfe77e4395aae100feb1d7723956d1b9044564073cc9c376f839592
MD5 c3b472018ea4c3f735bc716198dc38e3
SHA1 7953f2b0f863245e05d921db1950bb39f2cfc78c
SHA512 619ca4b96019ea92eb6b05ed5886825a93ec5ef7d45d93cd228e8e8900b23b41004808b9a6bb8267da1ab604fac6b04c1ae6ce5f6466440bf4a54eee138ed7d2
SSDEEP 24576:ym5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ym5LNiXicJFFRGNzj3
TLSH
T1695523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3c3c881c173d64700cd19cb7539bc246be2fbf66a4d175406569802e55c474b5
MD5 d97d271c7b9c31cfaaf74fd04715e2c2
SHA1 bdb2a0dc7c555c2feaf84ba2996fa11b1fa6e75b
SHA512 613a690f4cd8ba8ec82bdfdb425c639d68e975d255af122bdf0425c031ff752008508d4b9937268d62f5ffc5504c7d5ed445ac2dadb32a70bf3da6e9854afe9e
SSDEEP 24576:PG88u8FpJqH1vzria7/md5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+7ZFPqVya7/I5LNiXicJFFRGNzj3
TLSH
T1B285F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a7cdea673f9e0fdf2d4e37f9de00c3072b4693fafa23fe3836ffc07fd142538e
MD5 29236e2f8428538745754975a572adeb
SHA1 1d60d7b27811fcf1c08dcd8c42e9225c06e60dee
SHA512 c511e1e244929455573e901e18e00045b52cb6aecd830a1e8dc0b972a321b84888061a543c55461ad84b277befab974f5a0c1e27ff2bbb7b61ef65dbaffbfa21
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp5LNiXicJFFRGNzj3:uG05lO43b67wRGpj3
TLSH
T101D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e005b1554a2a585ec51391016ca008709ffb8b720be3a0f09b9a922ffdd7740
MD5 bf330d637265c74258d0ac1aa3639ff0
SHA1 111e05651ca5174b832f29da00274f3a8f31187e
SHA512 db5289d971c8dbc0a3a7cf35e2cb4a05aebdeeb3cd2dea42df2157ecbca2b8afc54660ee91d00573bad1a26a213cae3f2e6e6d51178c11c5bfc3a3ab379d473d
SSDEEP 24576:Ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidnT5/TwSfVcYG3K/cJHlnFR+IGNe8c:Fa5POZ3lJt2pasx2+mB5LNiXicJFFRGN
TLSH
T11D65BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 683ee144b8c075f7ef71b68dbdc98667f42023d5d2502dae62937852b53027c2
MD5 8d166749cb5584ad13f04bf7f50ef297
SHA1 a6cef058b4b32246a04cb4a85346f5c5fea30293
SHA512 93be9f5da026352564fc1fff55abd83d4b404caa49d39c07cda24dd7ab6e172ba43f4abd8e40f4bb1a3193a2aaeaf5ce5261c28699f08b7b228f544616daa19d
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkV5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oNc/zEOVHFo5LNiXicJFFRGNzj3
TLSH
T157858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 bf766f1ea7af58a9b05345b0a26820176b556175d84a7f865a09d8124beffc45
MD5 6830976e05adca2a0bdb6015c7890b44
SHA1 c9ef9f5cabb8f3641b05452532b07fbb69a890c6
SHA512 1098027a79297c4d60d46f5906b4da877a9b755d6f71ca944929d67e63335fe8669a929730c862705b28cf3977b3d07d0970c58a75009302a09da7ddd8a1a336
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYg5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pgb4mBIBhGFt5LNiXicJFFRGNzj3
TLSH
T11A65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7b683b90dfbd73b89c6daba0cb2b8879c93d1c902dff9878118280c87dadb066
MD5 0918f0df0dcb16b44a7539a9f43274cf
SHA1 adc315a672eefa857d7171ffc116f2fdcebc3c93
SHA512 3b37194c95174d510c8fcbd8f9a191a608be73e8d580be0a7fc29ae62af3a7914a0323bad447d9d230d1d172e91858fc625cfa542a617e658a4af18f8b631a0b
SSDEEP 24576:xzkNvNnaFeYhJNtmZBmX5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xzMwBtOmX5LNiXicJFFRGNzj3
TLSH
T1B455AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a3dfb6a33fbc5443f46831895f6b491bbc493a03994422d5598b87dcedbc57e8
MD5 c9f61e7db0774ba56abcd0ddea6aa1a2
SHA1 a7c60e322d104b2aa5d33c5fbccd296c4dce9601
SHA512 9db532e0d31d474f2f3892e1cb07dcc92f390cc9b93d3ac195556487a6cfba095ee94b2ccf1eba7d9ecddd6ad8f4cd645f35cd6663084180a15043dc1fcd9b15
SSDEEP 24576:mPUr+NQ55/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mJQ55LNiXicJFFRGNzj3
TLSH
T15B65F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7133deb7a5d761864aca81ef9496260e22c70cb7e9e7028966c83cac98523173
MD5 12826751ba0d3659158a6be4cd161e4d
SHA1 2911bbf66be6355b6490e9d162b6fa29c0dc9a33
SHA512 861629d025913589bf8667ee53d1ac6eeed9b994ed7ae82587a533bc1a3cf8cee83777e0ca2ca28e050895b7919c6d236d7a9b56db0c29303d83386e2befcba6
SSDEEP 24576:wD3FHshBIYQgAq5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wDVHeBIAAq5LNiXicJFFRGNzj3
TLSH
T11575E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1256-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1256-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1256-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1256-345-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/1256-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1256-347-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2392-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2392-77-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/2392-329-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2392-82-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/3060-205-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3060-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3060-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3060-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3132-157-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3132-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3132-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3132-349-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/3132-350-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3832-124-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3832-117-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3832-348-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3832-118-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3844-196-0x0000000000640000-0x0000000000671000-memory.dmp

Download

memory/3920-1-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/3920-6-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/3920-7-0x00000000023B0000-0x0000000002416000-memory.dmp

Download

memory/3920-86-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/3920-0-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/3920-182-0x0000000000400000-0x0000000000640000-memory.dmp

Download

memory/4072-49-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4072-39-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4072-45-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4072-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4072-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4116-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4116-313-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4116-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4116-66-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4388-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4388-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4388-362-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4388-364-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4388-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4388-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4884-136-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4884-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4884-142-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4884-130-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4884-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5368-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5368-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5368-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5368-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5428-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5428-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5428-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5428-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5428-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download