45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
Size 1.5MB
Sample260702-apl8dsat6t
SHA256 45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081
MD5 3f7e1cd42f2ebe63f40a902c728aef20
SHA1 d980a155926d5a17723ba75badf544efe800b252
SHA512 f799c6a6c09640481b20dbbd82d40e18f13986af4c87a18b7be1b71a22fc5ca49e3fdf8364868c80a5214a751642dd4b9d781d64d4bd564278befadb73b990aa
SSDEEP 24576:h2LPQvkyt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hkP4kcLNiXicJFFRGNzj3
TLSH
T13275C00263E405A8F9F7A63889F69121EA737C895B38CA9F0394455E1F73F91CD35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2540	elevation_service.exe
2752	elevation_service.exe
6036	maintenanceservice.exe
5816	OSE.EXE
6132	PerceptionSimulationService.exe
5784	perfhost.exe
1356	ReFsDedupSvc.exe
564	SensorDataService.exe
4860	ssh-agent.exe
3268	AgentService.exe
2572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5809200dc4173e65.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104437\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5cf410ab909dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007c69550bb909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039c4e34ab909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094eb2a4bb909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b18f70bb909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d550700ab909dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2540	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe
2752	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2688	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
Token: SeTakeOwnershipPrivilege	2540	elevation_service.exe
Token: SeBackupPrivilege	1356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1356	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1356	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1356	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3268	AgentService.exe
Token: 33	2572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2572	SearchIndexer.exe
Token: SeDebugPrivilege	2540	elevation_service.exe
Token: SeDebugPrivilege	2752	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 5404	2688	45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe	91
PID 2572 wrote to memory of 6052	2572	SearchIndexer.exe	102
PID 2572 wrote to memory of 3376	2572	SearchIndexer.exe	103
PID 2572 wrote to memory of 5672	2572	SearchIndexer.exe	104
PID 2572 wrote to memory of 6112	2572	SearchIndexer.exe	105
PID 2572 wrote to memory of 6088	2572	SearchIndexer.exe	109
PID 2572 wrote to memory of 1320	2572	SearchIndexer.exe	110
PID 2572 wrote to memory of 3116	2572	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
"C:\Users\Admin\AppData\Local\Temp\45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe
  "C:\Users\Admin\AppData\Local\Temp\45575c8fda5bbcb87aac8133bcf9313e8f20df2426a07592f25eebcafdc04081.exe" uninstall
  2⤵
  PID:5404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6036

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6132

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5784

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:564

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3268

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2132828192-1552876075-2324613956-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3004 3000 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1320
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 692d9e95933e40393216e5a0f3a9b380c721af3cd92c8051304f63237d5d28e5
MD5 01b110b9db51ac919da34e82df363536
SHA1 8ef30c34a82ce0350f327ee7ec5f75461fbe2c03
SHA512 c660349100faca1855492b8fd5f5add63a50300174b02319500f79e58f0b8575132f535ceb30805033bd7078ae405ca00cc3f5158add9d56cba6407ecbf28164
SSDEEP 49152:xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnSLNiXicJFFRGNzj3:33q6mjBl7wRGpj3
TLSH
T152D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 141e39a68a4849fa3ef236f527cc63a84bea6bcec9124caffc1bfb41407448bf
MD5 499d5aa8ff5be99d35a7a992b58b87c2
SHA1 17321cc3ae750c01d46268c6cf2458bb65f53574
SHA512 94de43a71da8933ab0ed0c9861997c173621735413f138db18c535a60157ac7a5dfec316e661a7290d019fe4593479df9c16c8ccf03526fbbc8d5ee264b310d7
SSDEEP 24576:OXYfDtczA5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NtccLNiXicJFFRGNzj3
TLSH
T13C65012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 c3b7cd1f8f9d25bddc8317773f5e646a2745007a7169f3a01d715bd34e2be705
MD5 a5bfc66888c557b2231455167a98a245
SHA1 bf0bd757ed824f23aadfb75c911546ff9de56a08
SHA512 c76eb5a3686506f59f0ae2683068ba9610793e5a2c47281546a2f7bce90c8460da93006d2e4504c38081cad5752766ca157df486ff6a56696214b5a0d97666c2
SSDEEP 24576:y0Le5ji0hmxLrMi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yPji0AZnLNiXicJFFRGNzj3
TLSH
T1A2859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f4ae0d4578ecb28758bbe0be706e168a1f291aa59eb6b72bc99351bdcb583b27
MD5 6670116a4dbed7536b1361104485050d
SHA1 9c416107a2169dd3db94344a16919c9571e81f79
SHA512 f2018660bc64eefa0db9f818875a3b54559201b0047eea046f42758c165b0b8af1739fe95ef9d2bad482df7c8396ff4e1e7405d9aeeeeb95899e2aeb2029ecbd
SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWj6q8wyus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:J/ezSC6vUzPv+HjyrLNiXicJFFRGNzj3
TLSH
T1DE756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 769fe41714576e7d53a6a34f3a1673b00ed535be8aca2c54e4e5579f68b4cc0c
MD5 fbb905e5bb5956eda43e208b75a1db05
SHA1 f620a70e2be708f77fb270cea37c6d1a772b7548
SHA512 6e85608d17e46b25a801daa4eab527d7c91012b0a328c76a59fc4f186103e0440210b8b8866fc8bf9e32e2262b4d547d1a76a9333cde614cfa2bd6bc3b8aaf01
SSDEEP 24576:vVbqPb88hv/l+BV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vVO88hXl+HLNiXicJFFRGNzj3
TLSH
T178559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 b4920b28a98baa03bb9be45594e36e3227083c5651218692d83347ebeba2c5cc
MD5 6fc2e642d0fc98ab1cd13d5fb8dbea64
SHA1 5cd8f29d0fb9c7d0269d64b67f7dcbe639c430ea
SHA512 2c35e002f9c61ce1eb19bff953007d8668dd2c4acdba5c13494e79630e6df9dc1295ff95ad77a7686fe5413907f34c7f124d125907459ee2670fe7985ac2fbdf
SSDEEP 24576:HZ+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oLNiXicJFFRGNzj3
TLSH
T1774523D3468854B1FBFD003A867A5828B5845E2C9A555DE3D2543E5EA23CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4276a8e17e6aa76b5470d4c6a4be7136cbd23fb1092f9a84113b9aa6c555fd92
MD5 b01188e656ea445b2701710919569701
SHA1 6519a1f20413531346883565f4f8c9c11f280c13
SHA512 eaaa24daa950e840422e599cdec2f6b96983e4b87c70f6ae60611ba57c244ef4fa77f9e5f60cff0ab540951a24a594751b83ed397b8e606e2fe448dfa564dc2d
SSDEEP 24576:xJIUN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xJIUNLNiXicJFFRGNzj3
TLSH
T14165CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2142cf6313a4e853612bb0dd683e42c3f516f876451e3b223166559f446ff3e3
MD5 95813f57eca8843b6d5afc752b68c76c
SHA1 69b490ed007aaae66fa7f64036bdccc33a3246ad
SHA512 c6a5ac23efae874d54372abb80e1bb4c7b811c099f39e01a25baeeda6f467048ea286be1a547d647b539f7818ef4c63cd3ff7dcc237017f1da06532928d7d721
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:3QvGAdlCEL8c/WRNw5C87wRGpj3
TLSH
T14F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 cc23d73ee4a57dc9e8951cfd7d113e7e0f01cf3dca1aee561877976c2fd275ef
MD5 179e4c039a0f4d43105fa3799eeb6ab9
SHA1 133a9229750ee82eb1418f58da5aeb66d0f7c992
SHA512 643d0407b441061ef20321dddd467aff3f030109cbd5e06724d5798735bc66d22f79113a8401754314e1c1387a744bdfe55910d4d60fe723bf2be692bdb79c9b
SSDEEP 24576:vxewsAj3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5lj3LNiXicJFFRGNzj3
TLSH
T19875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cb5029ec7fe91fef0e2c85f5e31abbaa1b6f5270b4b143bef35ec7928d6fe9c8
MD5 4d8c66abe36560fcb110cc506e1c3dd5
SHA1 5e0b136063532b24ee1a33bd50ffedce1ef35933
SHA512 7a09f07ebd2583561b81b3849c48281b16390552e600164e070768ad1ffbcd9ca588f44445b18a3cc32b5dc2eb649e3b1a43e7c769d1d3e510ae6dd92b47599c
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHDF9:JUEtQevvqc2W1cpV20I32h9
TLSH
T142474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 02951c3d1f7a050ea316f8e52d8ef220cde70f6c88eddf96106e7edad0f300b4
MD5 1e3b08613d92eacde4c04a9b4fed1313
SHA1 660940cd3e69c7c494d63e00629723cb1e194349
SHA512 c0b3cc0036f59ad30e935bd24a1e79a9b2a3562aadefcf0ec042be1a3d9e403b4b041402138d25363bfcf920919c26f01d0c0f1e39611406a7f5cb91086f04d3
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zXLNiXicJFFRGNzj3:uoq2Vjnmg7wRGpj3
TLSH
T104D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 58fb8ba2a27ddba68274b88c85ccc32456d6a67786da1fd41581ad5544ace232
MD5 d0e2266adb636b3d9d86bcacd36e6ed4
SHA1 61e48d6e3f91fd73c2764c2ad5c19694319a2056
SHA512 93ba06df7449834be623152e2dbb1bb1ddf73c9ae4e2e5c718d26750c41916f6f61ff199676552471c1ab1e87436d901e95721f1047a8f1170b22b3c14429b73
SSDEEP 24576:0AhGL6IFoiwtA5l7S53A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0AM5Foiq5wLNiXicJFFRGNzj3
TLSH
T126359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 d4d26e741f738129243ed6eadeb7178ff99b17e4b33c2d7433915910dba0c589
MD5 0f84191bd28f4635856f17c156bff47a
SHA1 d5e4c879ad5af3a5bb32d741bd118f38e09727a4
SHA512 a5ee72795bb39f02fed7e45dc6dd902a5f87be6a40b7dafd6648f5fd4926f6037cebe765eb7e03c5d659be328ac419b6d140109e1a1fb22b216a5205aadbf4af
SSDEEP 24576:EwuLOWL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Ew4OkLNiXicJFFRGNzj3
TLSH
T1D965F08632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.2MB
SHA256 1473afacceb533fe033cb074020623dd673558c8c46599845dedd077ca152d80
MD5 cc57647e2b7ee3cc2554e2070924bb39
SHA1 e0cd322aaa8dcd8ac2f0095514098507cb03efd4
SHA512 e4910bf14e211f711900f7ed91f9d881141d3c7b7076d9520cbd58166f33d9a26fd8308d35a8c9f6e856b68deec5e376821377b6a089e633246770e59f47ef79
SSDEEP 24576:ZZu6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FLNiXicJFFRGNzj3
TLSH
T18055129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9d028cdc09b8e11201d67855aa1a7011cecd759c584b56b1625e2f51a6ba6c56
MD5 a88b03de67f768bca555caf85e465187
SHA1 f1245056dd56ad35a25c96ce09300c69d1ab02a3
SHA512 bd4056fb1a3c29e7dd46f97a73c91503e921569a96b2938d20ace013e4dbe2bebcadc1026d1940edec06df6e0738bc1560a86a43aae1856e75bf16985bbed0d3
SSDEEP 98304:HQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:WQyiKanX+PNFF9
TLSH
T135667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 447c8500bcee1432247a917aaddc8233d3d881b086879e94f9651239b222af9d
MD5 f9eab24604850f58a18ee52068638f33
SHA1 12537c7ec8057101ca275b4cbe91258b4f92d017
SHA512 ad5b3add450060415afcb9f08630100eafd5bebed3c011bda4ac8fd9f754c16cf6f554ff7c4f279ad2a073dc98eb9f40d876cd1a690de4520f228c5ee08b2edf
SSDEEP 98304:GQRQyi36YOcPDLvw2gAf+PN3R7wRGpj3:tQyiKanX+PNFF9
TLSH
T1BC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 266677d56e5fb248ff7ddf1ef5b88481a7e8c49d60e94b0c838731ea99312f69
MD5 88971a3e0fffbaf7af6abc9c671605e2
SHA1 88f6261e8e66c9003c4b10bf7c7f951b6cf3dc7d
SHA512 10440be8a40ac400a6e692d2462357d1319224b63aaf6778dfbdb650e8bef98562d3a7ba2b61de3446bb69c3624b2718787b932de46578758e8ab5aaab7cc53d
SSDEEP 49152:c68Qg55nhkeWu7PNU3/nLNiXicJFFRGNzj3:WthTRc/n7wRGpj3
TLSH
T157B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ab458e6957088e6bf24421f5108322acf9bd970e6770ff4e4a8d1067138fb25e
MD5 810403d12dfff161faa08454230ee6fa
SHA1 ff84f4468a76b2197dabd08b7b82bfe73cb1d707
SHA512 40a70bc3183b3d3678e928752e77bbf94b6a4dd717b30014cd801435e9ea73ba132edfbbb537d820014b4b98b341492fa84e323e360c4df0b2bef38073cc90e1
SSDEEP 98304:Dy5112gYy5azzVvU69nLKnhZ+7wRGpj3:eLIHRWhUF9
TLSH
T13E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d2ef6e2b099e61a147ee0e287aab5784c3bc7592ac3661316741eb78f96f4094
MD5 1bb34d61db47235a2e1886242f2f0b99
SHA1 4ccd62e920c0f3e09c885e0ffd619705a5b1b1b2
SHA512 69816a56bc7ee40c35518633a050b5b0268dc9ae2e7cf78d83fe346fd782523a34445dd7ff0873bee78c51716d599b08929e93e3eb5c604c444d4080fdc93d24
SSDEEP 49152:9B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBLNiXicJFFRGNzj3:ju6JmIxd2dB7wRGpj3
TLSH
T1E1D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 77c1e0acad7f4e68eac218342c45fe8aa75a9e4b59316fdba515b4eeb21479c2
MD5 35a2cd65920f738fa680f5937397ca79
SHA1 3b063ac59fa8a2948b06808c51d5cbaa2a5eab2f
SHA512 5458c8e23bce3c921737e3834e66f1505e5b1678373aa66f90d96c4f03d60702cca7c6112e475fc9c36e65b832a2c9e7ccc535da9fbd2cd86ac4def40b67be48
SSDEEP 49152:D1hpsNoJpF1A67U44CwH7R4xtLNiXicJFFRGNzj3:DmifPqRg7wRGpj3
TLSH
T1B6B5AD13F29900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4cceec8e7bd495c0b510a868dc7bc69a9ca45d8d067208798d39faecd9abbb14
MD5 465354ebd8cd40028eb3ddf97a827f77
SHA1 1aa8a721b5a4bb0c6398b450d690bee010cc72ef
SHA512 047e42345c8362f484718377270df68ac1145c880c26abc0da7d65cc48ead2176167fa67b38ab6c1b6a6e60bd17664984998ee8cfc054386766c2b003263b68e
SSDEEP 49152:ESuZQIY0Be2KkRVtOnks6NMHq6LNiXicJFFRGNzj3:W5dKqi6167wRGpj3
TLSH
T16AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac0d9f00fdc26ce5428c5be13ecf2cb7043785a14ce68af2a379bb030c58c7c0
MD5 0badcef83836c049be204874a481ecd8
SHA1 8f30226be7d2ac74b1f5b92c439306c5f1d4630d
SHA512 e21539907a47cb0aa4b7ab80599e10b3915e2e99fafce84f5705a45e2ec0a203c678492aeea3b2df4bf93e716186aa9f2b3ae58e5cc05e713a6c40fc491bdef3
SSDEEP 49152:hhtSn8EApI0figjgiDn0AP5w5LNiXicJFFRGNzj3:wX2iWphE7wRGpj3
TLSH
T1E195BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fa0da0177602db697e738f9a090f976f326782fdb023f8f95638cde263e0218c
MD5 4d00b33f62ff2f297fcd8543aed58eb8
SHA1 5ff3bc903f489d444330f169b93cffaa81f52931
SHA512 115afbcc191980b8e52827b477af24cafae7d8e4bc61e5bbddb9ba7ca24fa8b3e688b34c75011017cf6157ea902d0184baf729b9fcec8c340c45a325cb8078b7
SSDEEP 12288:rMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1804523D3558955B1FABC0039C6755428F5882E2DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 42801317fcbb3817b56312697621bbb073cc5bbd8bed83aba21d8b89f7362e3e
MD5 9da0d23e81e9f5742333f5c7557f1121
SHA1 33f37f186a18a68ac7ba8500ede2fb382b05fb66
SHA512 c568a36a1a197f8056addc784a7a58ef7d7c93bce39ac512e928e4368dac7c38ab4bf0fc0a7806e1108258179869ce9ca8fcdbd477302d8c42db30603ea3b1e3
SSDEEP 12288:aniJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:aT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1244523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8e0bdb19456400779fc5a322141b1d09547919cf022f252a43472cc1715b6370
MD5 75234a62d5f8bc68232bb7be1501dea5
SHA1 98fc1091bd0c19da6bb1484c8586da2b8590b9a6
SHA512 ca2c8c09a1ef28364c3035e16cfde1030cc6bb53eec79f5f9bf13dfd9e1050596f54f0565d1a6631e93d3381e6a26b76fe240c1a7d0ac3db6338e2e2f9a6af9d
SSDEEP 12288:cZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F4523D3558955B1F6FC0039C6764428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 58d5c789f39c287aa475f5a917ec71297607eca19841ab4426ce6bf7f285423f
MD5 656ba19eadb7727f3b489f22e62f7dc3
SHA1 4a3f696f8213609e706825943401df190e05c33d
SHA512 b31137d41b39a5f73d1793f10a7d26b4a63982c397fca0ecee8f7b1991d4cd5591ae9245ee10d1171116b79d8aa179153ec5d43444d93f9f7c8a266fd2279baa
SSDEEP 12288:BVWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T104452393168901F1E9BD803DCA764424F2A47D6CD7325AEBD3003D1E5A74FDA9F38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 d1198eb9f0968cb8fc4f1c8d4529746c08b019f681a9ea68228f4e458d24b547
MD5 71d2d89c45c2ba9cdb1ece855fdea4ec
SHA1 5215050bd6c35c82cfcffc3562a6d3efd6cd3366
SHA512 6bb3327dec8e94a14bd7e65d25fbfec402881f5cc60788c69689504da27745579a422b1508ce4288664716525794f86adcfe113e7d67f6362d1b088e1533d4e9
SSDEEP 12288:peiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:po/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1254523D3558955B1F6BC0039C6764428F5882E2DEB5618E3E2483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9fd842ce5204fd26548ebc8823b9b09f733bdf3890aa0d1636e27b7153181ef4
MD5 83ef64c5234421b57e61a7c157adf627
SHA1 4a25d4b0ceea3d016587dec00be1483edf6ce866
SHA512 f6d47af3d07c9848c1d8cabef52827eb9268de45de62e6bd7fc5659f81e9bb41716377b3b6a5fd45b05ae73721ccffe34018f0f03cbe6b6cd29ac2f06ba9293b
SSDEEP 12288:27iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA4523D3558955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 738ce7d3d87920cee8a4c9981dee49db2008ab896dfb7442aeffbde43ed6ac5a
MD5 dc8bafadc7de85042d671f6d4ab404b6
SHA1 5c6b42ea314f37365b189aa2d4748a631d478879
SHA512 a271b4a717021bde0b36d50778d44e240b61448fd33f944398a6adf9b48f2e7a1af7585ae79e2b3f62d44447418fa43a08bce855ae7f4877f14387b6f6e02a7a
SSDEEP 12288:zPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:z7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE4523D3558955B1FABC0039C6354428F5882E2DEB5619E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 aff640c072ea32abfb00d86ffcd0f65c9ff9123347b444e68411a1fd538a20bf
MD5 821ea52111582a0d7b6cde650cd9f710
SHA1 8e20466b1b4fa097dd50257ee764cfda3f5219e0
SHA512 f4002d3110a1a805ceab62263af38634b53b2f9b1d6c962863b68a1124b56c91391d5fe8b7a74e5716f7f500a3b4c18ca82071b182eda08f4c18435e5ba81ff9
SSDEEP 24576:BZMhzFVSOz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BZMhzf/LNiXicJFFRGNzj3
TLSH
T155650295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 93a377e9ffdadcb4fa2904c0a41f19440bd889c6ad294fe3e29e08f517a6e93e
MD5 adcf8263f6f15121910b3e849ab791e1
SHA1 3bdd9ac0d7845152d67faeb325e126acf0f74ec1
SHA512 2c0a87f770e7e30f46fd6b4a38b99abcf8393ca523cc34bacd913b224702b623fef0e9c5678d855be083abb885363fb747c7009e94ee3952b6b65dd06542aed2
SSDEEP 12288:V4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1524523D3558955B1FABC003DC6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 868c893b210739c045e3a824e2d9ef67a533e58e7820a79c2dce97d538fb5d19
MD5 23de7067e100993e2730629cf710f038
SHA1 faf5081c48754613c0cffb19cad244e64366b451
SHA512 4a2d98f33bbd682275a9911defc71f9ad09e9943428eec9161965506c7e47a157351a49403629dffd149981ea5ecf941ab189595444cc020d6072480109e1682
SSDEEP 12288:JEiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C64523D3548955B1FABC0039C6754428F5886E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c2479cdd08375c54f1597fa32fdf10872fb301d3f53ae73b526c12e2c36ae81e
MD5 599fd6ab1ab7c51b841122bf695616d7
SHA1 963fd861821f261d4b1631ed1c9d61a68b5ead26
SHA512 4a77f1c00dc32fcc7b286206a3d174a7812171cbb653b6dd70e53de42d10a5efffb91661b9b3b58f150099c37dea8a13b7fed93a51927d6a7c4a3847aeb0d856
SSDEEP 24576:lzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:lELNiXicJFFRGNzj3
TLSH
T187550247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 54f9bbbb62ab77b0fd50b0a4f443e9cd4e03c328178076f8340b0ec4f125558d
MD5 83324970438393249b5969c0e9538dae
SHA1 a09f62a9f99fc3a3a1aacb6dbe08c7c7eac1612c
SHA512 da3c12bf177bdfd022af65eb9dc69d4610ebb92a761ee34ca05b704c4cc81ddea058e8e3c48797634f880abf4eca481c56f299e70007e4dc3173916ec8e29f55
SSDEEP 12288:z4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:zK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1144523D3558955B1FABC003DC6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 96fa3e36d920213f80dab7fb332d84e2f273121cf67b87b3bedf786382284528
MD5 78860ee2e82c98e263158ca05a276936
SHA1 4aa624de288b2f83139ae80c0a55490cc3a7438f
SHA512 68dc891013493650b3ad2ebcf30366595b74c1094b11bbf2fd70c0cfcf592d83c4e50301b396ac8ca10f5214b20ec5453cf113c9ee094c275ddee00a17e44eee
SSDEEP 12288:14iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1354523D3558955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 dc749fee74063fdd1ab118ad4ca7c86593f52a1d0bb11f87abe1a62f42393f4c
MD5 c04cee6612fe0fb4cc1694b8b3dbc0ad
SHA1 71a184cc8af0bbca8d5d2cf2d4dac6dafc236881
SHA512 906fa7fdb0f9b387f51e97582909a7ed8823e6c5c5d5d7dbd4f68648b9cfcbf0624856913fa61d49e7f084c5242efe0f6f7e607a544a29c18f98e76cf0149a53
SSDEEP 24576:TzyH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TELNiXicJFFRGNzj3
TLSH
T1C9550147629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 f43b7d7a06f5c43114bb59ef33f32ea6351323199cf1c713c984898174b6371c
MD5 86de315c9395e7f2c99f4e7fe009b1e2
SHA1 05a9ae1b5892765b8f7fede67aa0eb1ff86ad80f
SHA512 aa28c7a40f56cd45dc13ddf193ef2e75726005f83c921e64f4460864daa67930ce4cb22c55eb8915d72cf92e2877279d8035ce4dfce6bf24f2728d049c8bc43d
SSDEEP 24576:gTOaLl3z0zD1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gT9LljsLNiXicJFFRGNzj3
TLSH
T18B6502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 65b16b8f59719e5458d598e4a3a0b77f5e696de1574f539886c63b5e6f88adc9
MD5 953248758f516f115997a4848b3cba18
SHA1 9d626d8dd13ee5c1d8e4df119bb6b962906592dc
SHA512 d76b734142a4f9e113099555b0223bef59c2017f3e58317a609197c63b9df179b315d8ac424b96c72e32a6ccc6acdcc88c743a93d852a32055bc08edcf405555
SSDEEP 24576:A3od9CHKy7GZx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Kod9CHKya/LNiXicJFFRGNzj3
TLSH
T12675CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 5014c0a179be87e879b339893e8c191f4402c1ce4d4493e887361ca15f29a86d
MD5 870c76100dacbb0918e3baa27828b3dc
SHA1 0b17d4dbd9e72dd57b493fb51a9d8751404ed96a
SHA512 d76be49a69260761193da366307d3a7965606249427f7668f49ad0d652727eaaf8fc2b529dced81f4fda0683a5cb61551d45df17f1a3d5651d36793b72d320e8
SSDEEP 12288:R5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Rl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1444523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f92372d8d82252e71e2dbb8cde4a50d6c2e41005da609cae1277c146f76d2fa4
MD5 aa05c3f8db8fe7b26c7c27d8231e8e4a
SHA1 3fe41dc620a76ffbb4842ef7b138075ddd07a394
SHA512 f9a71839e4d6482f2003234806f5544e82d37113683e43af49e550d2f7be6e222bdf24034e32fe179d227b9b844fe1669f0d51438650a4eca95acbef0ebd9f75
SSDEEP 12288:KTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F04523D2558955B1FABC003986764428F5882E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 637eb8d5531eb17e2e95ca872f86e2334331ed98b23f41325c63f0e8be004ebc
MD5 3d2f027f6020038b6330c295e1471895
SHA1 dff9d4e6b4d8e1175ff7cc5c3ea1df85693b4ecf
SHA512 56b4225f6966b7a1fbbd084fdd996b23209bcd5e9d1144e8bf163a9019b38ec87fb6f1423b1cb36e85eb5b4808add95522d80e387a2501e2a71dd1261d01f10b
SSDEEP 12288:MyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:MU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1884523D3548955B1FAFC0039C6354428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d6aa50d925ed10c8c265620103d8f2224a2368bc53e451444034e9fa5247c080
MD5 e9c3ebe3bc24630fdbf5aa6ce614412c
SHA1 874093ffdd1c507e551097596ad8986e3e7b1a38
SHA512 6e3f338388650d5f77f6beac926b732d6b07f4cc0add201b9c48870aa10b200d584dfcabb3c71cf1fbacdac54307d9681dfd6a6ffe31d749dae8bf0f62ce0865
SSDEEP 12288:r4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1034523D3558955B1FABC003DC6354428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 6a69409805776ea3ae9be91688c424357ae08843f9ab0f8130141fc1a4826eb7
MD5 ffd6d294d953c5abaa917c04248d48a2
SHA1 ed917c22d5bf268d249de59dbf5334ae209ed472
SHA512 bd8ba25f24048a13364ae0fbcb9b72f8cab8c27730b1f1d8590508a28d9827497afdd58a1400bf45990ef32bc869b69f0417c37eae199f93e94bcde9c0a74592
SSDEEP 12288:k5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1614523D3558955B1FAFC0039C6754428F5882E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 44d1b8a7e1ae66c6996c0e56545eec87315f6faf3a99b671fd88c9325bd6741e
MD5 befa6fb3c7e01e24482b826548520803
SHA1 0ea699a8712f6b1e0f9cdb38395706824bfc6110
SHA512 52ea38e3bced09b544829b6b8df76858b148d2a26f3b2dc36b26dc15aa593ba250d454c03024414d53a63af78b796cf8886d45aa516d52064cb7331e1373d258
SSDEEP 12288:lAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1884523D3558955B1EABC0039C6754428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 9bf96e5a4cb10eb6da4983c7457a813a425cd5bc4352b89522b45d97738b4576
MD5 b3825bd2f97eedbb74f3d48c684ac687
SHA1 84b3c213f661129ce4dcf6be84efcb2bf02bb45a
SHA512 1ae4d2d950447d50aefc8a4db0e103a8a5d010187fa9eb5701cb55716e356981a9ff0bc860bd4d51ba1aa1d20cf96fc4c703b12c75c9fe3694a920bda51c4cae
SSDEEP 24576:Bfwvdk9RX6wkyAIe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aMnYIeLNiXicJFFRGNzj3
TLSH
T18875DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 985b30b691569c0290e74e29a3ca8ad70803ecd07c04cd047c5584d0d7a6bca7
MD5 ede0db9e968493dab743076204f0f37f
SHA1 b3debf0fcfafb2e34874baef3c5f83a450592e78
SHA512 0a0111a7d93b5cbe25de810fa04806d448d159c3ab24b78ac8554f1f8f96b0a42b29fcd8b4dc6c777bfbaa64899a8efc1d2477751bf033c0af2a2201fb4503ab
SSDEEP 49152:JYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZLNiXicJFFRGN:AySzPx7wRGpj3
TLSH
T175066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7a8e77d3057db96ec3544265b0901124e410450fcf7123b720d7a50930184c43
MD5 869e99f069d8ecf323bf826fc20a3d17
SHA1 c3a312854a0176f4eda7c1e2e6236eb0193bc6ac
SHA512 879258e1bf50e5eb0b262ca3cf23375851364aaa93242c7b43c1724ceddc5a07cd683b9866403cb5cce783fbada7ad12b2b5521a48c97911ac8ca3717e2cb2e5
SSDEEP 24576:w47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w47JUQjqirIhCnDHUPfF/pLNiXicJFFS
TLSH
T16965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 eabfb400475ea2a174d01ea18e72f8c4f45c6709f22411bf2aef92438c7bd2af
MD5 70a05bb1f1b2fa18ee080a101e805f5b
SHA1 946f889a8845ca6bbed3abd8879a993171abd511
SHA512 0cc8e7e0c87da762045d0ee2ace1ed3d4d8e6631f4cb22e89a68ae15857b8757d38e67a00053d623ec6c1259729259c8d4ee7cace56279ee23ba79c5d1e2e770
SSDEEP 12288:M3sfIiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10755F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2d0a4939535c2964516108eace1990506d5ba9343afec217d01e910af8a4b475
MD5 5e903dfc6a5d8759fcfd0e8715ba7113
SHA1 7af0e83d9aad8d6fb4b008eda72782215068ce7c
SHA512 2b4d6d5ee1844ff38209c38eca406b32a55b6a576b6fce4aaa3f5f83d2606349f5e1bf84045666db522e25d7ac5bebf71ca2b68f26e99cbb4595324fee301b19
SSDEEP 12288:U/Q1St/iU3fnUx9Pod5ORd8S/0E5xHJHWcW6J8GE2JiEK:U/hqUPnE9nUS/F5THWp6SGE0VK
TLSH
T1FB350605766AC78FC66940321E32D2CCAB707D11EE44AB0773C84B3FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 bedef87d1abbd285d0ee9b2788ca09a50fa674458f45dbd1911ad8c9cb8ec3c7
MD5 7830862ef83a43eff2cc409c9197b540
SHA1 da9be71dba0a850a6eb470e3cdd6797e30edbc4e
SHA512 80039dc1d78dc31d8dde50a4faaa6fbc1eecf55b0ad38dbd5f83116570710cddd44a90cefa5bf03d2ff6e4b1db7fec581a8e2ce96fde27cf85586a12867b73e5
SSDEEP 12288:XV1Y0emiPa3cFJzT4fbn97Er92BnP5Ne3VF+/ktRx/WMv:l1Y0emdMFZ8fDWrcjNeqw/WMv
TLSH
T197750B44A436A38FC5BB6072073A9B8D6774EC16B7056F2773C8093AD86AB1570F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5809200dc4173e65.bin

Path C:\Users\Admin\AppData\Roaming\5809200dc4173e65.bin
Size 12KB
SHA256 99731d5f160b066f7f87c5eb2c5bb2f6b49548b65a319eba678915efa75807f3
MD5 39f953357db11a1ba50b9689eb40ddbe
SHA1 73cfe0f59c69afca9588dda62505b3e132b6f51f
SHA512 ee109de25881c867441c8825d6f0f4dda33bcccfbde54013312afa9ae1a6fab5226bee2b0bf6251e6bdb11ef9fad2a1c992c380e4675d1a584b9d4378524d61f
SSDEEP 192:/rzX6xm0uPjQer7IKzm6zaI6FeN610FRD1/AlYcFYq+Xzry6HgFjX5n:zuz+jLiCVweg1MbA3FYti6Sh
TLSH
T17142D06F1ECCE97B29365EED8F030915D98F6D84CAB0091643A24EE4FAF514C1E8B460
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 19b4247262179ac9922dad102151eb4a961178d08ac506f427cec0c08898d0a1
MD5 6a7040a0f4d364d21320a2de30381e22
SHA1 d5388b5da71c34904a52c76d5ca0bbcc17851c1b
SHA512 978abb10db2fd5940e0449aab313c6ad07da5dc09b751d157314d2bfe10e17f6c3b7ef137936a891522893fcacd763eeb043d2aeb9c373300264f1ba21cef1df
SSDEEP 12288:Vo7QiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:iC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T195452393468C59B1FAFD1039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4bb002a357c7d8effb64668f9eecc651550600d612dfaabb7b5f3fe396d63921
MD5 808a1bdb350950f1acb87056ce6cb84b
SHA1 2e0d3f2ee0effa1b2ac531bc42e062d322934482
SHA512 98cb637d9891b985a53d47211f4a0025fd8d7df967a946ecc813a0d4d06739e84277540fef44998e8f6eacd389b1e5a5d6ea754a858488d4edd9e0e14d86bf60
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wgb4mBIBhGFDLNiXicJFFRGNzj3
TLSH
T12965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 90ac9460158f024268c76aa56f8ab011b93a69b03962f8190256560d7a84a533
MD5 33b40ca3af608be7d20ba76ab1bb1076
SHA1 d6fed332b19fcdd22d90b4224fa65f10932c29aa
SHA512 2488c529053fe3692f495c41fc3cf3ca5f5e87220428e5dc5b7bb500833469727d1728279bb46d94ce88173e62acded25ff2d32bca02f7b7c0f671589fe892aa
SSDEEP 24576:tG88u8FpJqH1xzria7/mz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:g7ZFPqV4a7/0LNiXicJFFRGNzj3
TLSH
T1A585F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 85dc841aa546996bbee7f92b19f4aec9fa81fc72a1020f71b4c995353a3cefc8
MD5 b76277b06ad5d1cc426456d2555434eb
SHA1 053b982355f1616bf8e78d8a56fe7cb5c7d96ff8
SHA512 76bf9453263d225346ab150765822b1929f8798fb2f690d50bd5e5b7d4aa0ce2ff3444353afa9aca7c3837e86c8c9a7c4768b781dd073da4aefeeafa32ec20dd
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvLNiXicJFFRGNzj3:NG05lO43bG7wRGpj3
TLSH
T1DAD5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cb83cae721dbc27b95795453f26d36c87969b7bded414cae57087b40c44bed8d
MD5 8d516168bde9b3bd77899e1a99fc204c
SHA1 b43dd2b117fb285646aaf8ee7ae4a8d702d86e84
SHA512 af00faa5d783674001e8266dcd65b26ed07b1c70f74f7957f3f533e81a7cb0a7f0877a1f0e831aa12e8d5744664f0cd5f17f3f63b4c5a059ea5c654c70eb827e
SSDEEP 24576:5fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnZ/TwSfVcYG3K/cJHlnFR+IGNe8jg:pa5POZ3lJt2pasx2+mnLNiXicJFFRGNf
TLSH
T15165BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dc26e0ffcf5a3c96f1ea3e7544569f23e15014ce5943e4d5cfeae732adb0d70d
MD5 19f53b6b98e63eb82d70039fcc93b6fe
SHA1 ea675b927b96eeccfccfa6583108ed760b526fa6
SHA512 99bc6c6c746e21edd143148f42cfdd32e8376486de0bd566c180976122364af2b1c2b4c9946fc37d80cecc49cbe4985badffddad3e6d4d20052f37870adc8024
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fkr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7Nc/zEOVHFULNiXicJFFRGNzj3
TLSH
T1B5858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 eef3163475beeee1f4ebba1a68895b265b2f34c233b58175ccf85cf3bb8979ba
MD5 c34fbf382a16c8610bd4c6456079173b
SHA1 a675fc1a09d3bb77130af9c3e002cb2aa9b8ab15
SHA512 f1ab4aa02bee9ecf303ad1f63b9e4fb55976bff89e3658945a3aef2460d5395e201899c8bc0accbf9ce69c45a117899940ab0ee613fed394716b62555cc55fe3
SSDEEP 24576:bzkNvNnaFeYhJNtmZBmd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bzMwBtOmdLNiXicJFFRGNzj3
TLSH
T1D655AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 cb1fb1d0210234787063bfd0ebe94ae7824ca2ef90728a5147130cedc9484491
MD5 6360db163ac2619019d15b38e34ecb00
SHA1 c6fbdee2e3f5113cad0d078536cf19f9c526555b
SHA512 fa774eaf7c34d71244dd4ee5bbaae4c54fde1330826e4afef449220d849c52cd8766c098f035bd131bf58399aee1f3a2ffe396717e0d25ac87d73fb3a0a93d8d
SSDEEP 24576:GPUr+NQ//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:GJQ/LNiXicJFFRGNzj3
TLSH
T12165F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 d52f6bc8ba163faf1b23a417af503422b6fef359ce5f6b850632377504c8d560
MD5 4f23182f8a1e2c3344288c8d0e69dccb
SHA1 1bd05daf4ab41d75dbe86de7d9f9e3476248a330
SHA512 6a29668c82d2da3df586f42b39d72ccebf8bf8cf69ebdece71ae7f301d87f1f8b6de650ff39ba3cbf248a2c37d1a8d85767ce49acb771d82ec4008eb795067f9
SSDEEP 24576:jD3FHshBIYQgAW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jDVHeBIAAWLNiXicJFFRGNzj3
TLSH
T16675E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/564-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/564-123-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/564-117-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/564-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/564-328-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/1356-110-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1356-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1356-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1356-104-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/1356-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1356-342-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2540-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2540-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2540-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2540-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2572-159-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2572-165-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2572-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2572-331-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2688-40-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2688-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2688-9-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2688-0-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/2688-36-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/2752-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2752-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2752-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3268-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3268-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3268-144-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3268-149-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3268-151-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4860-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4860-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4860-330-0x0000000140000000-0x00000001401D9000-memory.dmp

Download

memory/4860-128-0x0000000140000000-0x00000001401D9000-memory.dmp

Download

memory/5404-44-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5404-56-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5404-67-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5404-62-0x0000000002020000-0x0000000002080000-memory.dmp

Download

memory/5404-39-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5784-310-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/5784-93-0x0000000000400000-0x0000000000532000-memory.dmp

Download

memory/5784-94-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/5784-99-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/5816-70-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/5816-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5816-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5816-265-0x0000000140000000-0x000000014016A000-memory.dmp

Download

memory/6036-68-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/6036-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6036-43-0x0000000140000000-0x0000000140170000-memory.dmp

Download

memory/6036-58-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6036-65-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/6132-89-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6132-83-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/6132-81-0x0000000140000000-0x0000000140165000-memory.dmp

Download

memory/6132-295-0x0000000140000000-0x0000000140165000-memory.dmp

Download