0ce3efaaaf3925401567cb3ef934409abeb116f0c3d32493a5f8d27143961012

Analysis

geolocation tags

cacanadananorth-americatoronto
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nova.exe
Size 1.6MB
Sample260705-176b4aby3p
SHA256 0ce3efaaaf3925401567cb3ef934409abeb116f0c3d32493a5f8d27143961012
MD5 3f80357751a93f91017ac0f109bbe3f0
SHA1 a4583d29ac216fb39bad0f6f3132c04bc56677ee
SHA512 42be3d6c4794863acf101e787072d0a62723d545893df9ad82742420b6f7ff3fc360769dd91b6f49644f4fea79f1f0a79ed24719923f5240cf995f31be2e7eba
SSDEEP 24576:g9DR3N3kmoPSnnrFb4PM4MYgLxEVyGLz:g33N3Looj4MYPVyGLz
TLSH
T1A675D0227906C473D5A9383905E5F72A36982FE13D33C943EF603AA2AD733891F659C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6276	elevation_service.exe
1404	elevation_service.exe
6400	maintenanceservice.exe
5464	OSE.EXE
3204	PerceptionSimulationService.exe
4812	perfhost.exe
2844	ReFsDedupSvc.exe
3424	SensorDataService.exe
6320	ssh-agent.exe
2084	AgentService.exe
4720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	nova.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	nova.exe
File opened for modification	C:\Windows\system32\wbengine.exe	nova.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	nova.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	nova.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	nova.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	nova.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	nova.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e08bde2ee819cbc6.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	nova.exe
File opened for modification	C:\Windows\System32\msdtc.exe	nova.exe
File opened for modification	C:\Windows\system32\msiexec.exe	nova.exe
File opened for modification	C:\Windows\System32\vds.exe	nova.exe
File opened for modification	C:\Windows\system32\vssvc.exe	nova.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	nova.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	nova.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	nova.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	nova.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	nova.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	nova.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	nova.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	nova.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	nova.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	nova.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	nova.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_88796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	nova.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	nova.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	nova.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	nova.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	nova.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	nova.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	nova.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	nova.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	nova.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	nova.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	nova.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nova.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c27a4541cc0cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009db53c84cc0cdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000315d5041cc0cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037e32642cc0cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{DA452706-B0F5-4F75-B99A-D2084EF6A917}	svchost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
5328	nova.exe
6276	elevation_service.exe
6276	elevation_service.exe
6276	elevation_service.exe
6276	elevation_service.exe
6276	elevation_service.exe
6276	elevation_service.exe
6276	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5328	nova.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2084	AgentService.exe
Token: 33	4720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4720	SearchIndexer.exe
Token: SeDebugPrivilege	5328	nova.exe
Token: SeDebugPrivilege	5328	nova.exe
Token: SeDebugPrivilege	5328	nova.exe
Token: SeDebugPrivilege	5328	nova.exe
Token: SeDebugPrivilege	6276	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5680	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5512	4720	SearchIndexer.exe	103
PID 4720 wrote to memory of 5484	4720	SearchIndexer.exe	104
PID 4720 wrote to memory of 3872	4720	SearchIndexer.exe	105
PID 4720 wrote to memory of 1724	4720	SearchIndexer.exe	106
PID 4720 wrote to memory of 4532	4720	SearchIndexer.exe	110
PID 4720 wrote to memory of 1440	4720	SearchIndexer.exe	111
PID 4720 wrote to memory of 5764	4720	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\nova.exe
"C:\Users\Admin\AppData\Local\Temp\nova.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6400

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3424

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6320

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1749168396-1890032557-311772428-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5484
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f8bfc350dfab63f0e9bc08d57a780c914943426456ede55869b861436440844
MD5 837e7856956f5367798d41758b434646
SHA1 488ed2ff153c867d583bc0f7feb95effaf1582e9
SHA512 36aff4c461cb17584472e047d478172151e54649af083fdf7711f15a8d2f7f0dc4253c89ec73247d16a6066bab3d43124a112b5103ff4a4a46f17edc7953177f
SSDEEP 49152:Rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJj4MYPVyGL4:X3q6HjBVVs
TLSH
T1A1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 0bb53d4fde2f5f5152b1c2e9d91755b949d704d8ea5664b9dacf350ca238aaa4
MD5 5960fd0eb73cb8b08e3863099b6686ae
SHA1 9a19f71ab6df102bf3c1a75bd11b364c1b2df525
SHA512 bf1625c79bb584f589db1397298f5c780169b51099a85f6513b86c8f5f5d1ecf25b07d25c7f774408061dd1698b20078f725edf96f24cc9f10ee9646a7df864e
SSDEEP 12288:i1XLsswWkxy2lRq2czAY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn92:oXYfDtczArSnnrFb4PM4MYgLxEVyGLM
TLSH
T15565F12977E408F9DD6B8278C8A28555E633B8518760F78F03E499662F333C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 8c4277f32d102f834b30e8c545afa6ca2e88dc192255d116a184c75e21af6eeb
MD5 201cb3ad7ee130a5b576a4f10883d267
SHA1 a5660c63470cf1a2c7c42f866071c922d902b0dc
SHA512 ed5e51f5ce504f70f1c62e59170e9d805a05db78fb60613e75f5a6fbd4151d9fc4b6e6891a330b9412ca41c46df0f305f411fa79a23c891ce27f7010704a1678
SSDEEP 24576:o0Le5ji0hmxirMWSnnrFb4PM4MYgLxEVyGLT:oPji0Acqj4MYPVyGLT
TLSH
T102859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a6876b57b6bcbcbd5d5a4b88ececc1e7c60d672f1ed8cf248a0aa2a2a416b857
MD5 0c37ca71d0762d39ad20e54e4435506c
SHA1 d6341433735974011233cda88c0481660d17eb5e
SHA512 3e19fbe9af4c5c9074e63fad2dbd83f5eecb080d40b8648bc246144d716d67b4746541cc66d124b0f93e6db37920504ffd85d982e24a0028fad1a160037ffbc3
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuASnnrFb4PM4MYgLxEVyGLV:I/ezSC6vUzPvxHjyGj4MYPVyGLV
TLSH
T152755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6e5d99542ae8dcebbefe1d7ce96d3fdf13525b9135440cd81bb548bcaa2d083b
MD5 90b96b21c11d7c36d40db3a49de0a019
SHA1 ff06ebb255807a862f08543563f2c3b019daad6f
SHA512 de3d272ff328d187aeaa94bcdf24689a1b90e0993674ec968e3fefaed767c10dda16c7f17ee7119bde534b33384c84bdcb33b934cb44cf57f78c1d0c3ca79b80
SSDEEP 24576:9VbqPb88hv/l+6fSnnrFb4PM4MYgLxEVyGL/:9VO88hXl+Nj4MYPVyGL/
TLSH
T18D559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 adb6d12195abbb9e15c0aaa667913ce3446d9987cc825e53a2393ed60f28d2dc
MD5 9d12be5c9b1813dddbea7d29615400ac
SHA1 5ca680e61cf8bd528bb4a758bfa6a1f67671673e
SHA512 b80a816fddde5b20ad21f876e1ed68a1f2ea6c11b8e3ccf92d54929a70f045c5fdb073f35092de83a7d932152eb84f476f0f58e63fe97efa1a7b15a19faaed1f
SSDEEP 12288:dRt34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:dRqSnnrFb4PM4MYgLxEVyGLG
TLSH
T17F4523A76BDC10EACFAE15B0D1B96AC8E205BC61F875B20B6750785B363F60DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c750d5848faa732ac73925e608c1c22b79469177c12a74240c7335ff13c17bd2
MD5 44718bed7334c0b0195081e3155854b1
SHA1 65e78e301b075e174be760fb97e9779c8075069f
SHA512 35a13792beee557f28452cf2e7a89310c84346070d44a1e2a3d0242abe653a011568c89b5dd69678f605ac14672a14f1ff77e9f120f8ab38a27275ccdb86185f
SSDEEP 12288:DeBNUbTVO86U834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:DJIUHSnnrFb4PM4MYgLxEVyGLq
TLSH
T1B065D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ec903c3b44521e5728dfe33a2e1b6a9961a64134e9a53ec9a3e66fc7a9b3dd1b
MD5 c0a30aa269144861d772c6c33aeb67c2
SHA1 3ed1e8b724e2c58ed626f0fb03f6982332a983fb
SHA512 a45258dd96232656b624325b3bc6254e7521b4ec774daa40d805f019993264536b9525312fd27b38a142f5a9bfea38b1fc79541f1f1172fefcf2bf73e37a9f53
SSDEEP 49152:oQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:oQvGAdlCEL8c/yRNw5CwVR
TLSH
T165267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1d2cb6237daeb12021f84800766e6f82715a42f70c1cbe99b59f114fc6fe71f7
MD5 74493bd1186d7d65767891219e55b2a1
SHA1 f6cdcfbabc9473732b0d4ce4d9919e25a0c2642b
SHA512 075a717da881b28f80a252a268bf3fb27e007f59befc6f384736756c4176ca604ad6d0ec606ca4d23e09396cd757b651cd21017d125801a3609e6ba2a0c26407
SSDEEP 12288:uAwSfxL/2Dc34DLLmt0LDQewsAjy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAC:TdewsAjBSnnrFb4PM4MYgLxEVyGLV
TLSH
T11F75E031FE74E036C7BF0DB21B36C716542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 767901c4fa81501f19945804c87710d57bf04041a086c1fa08431ef9617372c0
MD5 873d0bfffdb45fb81d2068b8677902de
SHA1 b2d28b521859eb1df8298fd5f6600f664c5eee88
SHA512 2f454ad5aa07b05a156bb9ddc08c34fce6fd6a8040cb3f35e0e0bd3ed742294fa37818415341b445ebecb46da58d5741896b3cff77fad459a30bf6575611344c
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:bUEtQevvqc2W1cpV2EI32
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 851720bd199110bacd897648340023b82ea0168d8ab24c4bff46784da93b75d1
MD5 5ad0951ebbda2094fcfac64a4600d886
SHA1 b62a83f3e06481f8b112668fed773a25672cb4e4
SHA512 914c1f7b2973f757903bceab6a401772abef6d9b34295f661d9b4da83f54478e0fc085aecb210bc1eca8381fc150376bc0f89f7712ff8e4a990fb52d8515009b
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zaj4MYPVyGLI:VoqtVjnmsV0
TLSH
T17ED58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e3cac4c95370e4dd19a69dd399da2f37b314af6b278eaf0a28f6b1b1768531ff
MD5 c087cead5ece6564d3837194713bdae0
SHA1 24e0118f3cea5d26385e2e470b62482822f9fdbb
SHA512 2187d8dd42bcd4d98bbd72e2c5e16e66bcefa1aab68e3648a9b0ca91b05735ca926a71972cb51ec0b640feed1a5af696a187914e112e6da922cb8822feae006a
SSDEEP 24576:VAhGLJIFoiwtA5l7S53cSnnrFb4PM4MYgLxEVyGLP:VAMyFoiq5/j4MYPVyGLP
TLSH
T15F35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f55530594d094d82a7c298c5fc86c44264f09e4d663f2968a9e3a2b6fe5af652
MD5 7c843d12e309b2e1da4ca7e5246f1144
SHA1 98e759ca076210e00d4e5596cd6beed2733f421e
SHA512 a0df040f38e74223a4b9e27f0472b03784a814ee7832c431729b176f40082d5d64d96f66a7ba1828406b735da011214740fb7c51e338eec35cb5890fd267f3af
SSDEEP 12288:Mmw5HEjsChNVBFgl0WDm+Cf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq5:pwuoOWNSnnrFb4PM4MYgLxEVyGLv
TLSH
T12865F14637E81CF9EAA74238C5978535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 705b2e77117f29c065f907bcdc80af2694f1b0d7997b8cbeee58883e8bbe9231
MD5 0fea0861a0548aef2c892c7523be8f98
SHA1 fa7d58b8c2312b70d4cd197be7661a2eab9a7788
SHA512 13568cb0cc55679ecc4ceb612f94a13506ca1e2a94b4756ab963a3a2be7ca208b2e20ff0ca120e5417911d90e98c71a8eae2ece6b48cf46916c046543a492fb7
SSDEEP 12288:IBZ1IyC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:2Zu+SnnrFb4PM4MYgLxEVyGLI
TLSH
T16D55129A37E820FACAAB4274C4F55688E3227862B73293CF1750655A3F37AC55D35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f7758f2b172ed06ad9c325ffbb8cf475e118fb0064d318048e6fd67400bdc1a2
MD5 910b83be08b29a6654e99bda0791393c
SHA1 30daa8d52e93fa961d14a67ed42195d04f157b39
SHA512 9d77644ab33a9e1cda2a52ec356fbe628b2ed33ebfa53065a2184f9c2f1055ab152d786b9b9a9561bc46832d8aea935a61f04c2faf8e1d23ceb0ec8d25826a7f
SSDEEP 49152:xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:YQRQyi36YOcPQLvw2gAf+PN3pVD
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f21a071d5cdab76a06e0b383075a92100f259969bf316480276147cbc1877166
MD5 5150e357e180ae1ce730482294dce6be
SHA1 32301f84a991e8c751605f9e9077f0162675acde
SHA512 712676c3433d131a136dba8d64e3ebe729cdd86af2b0f8f117c8faef7ba6a0eff4cd9325f780eabbeba1a00665bb9b47e263c7a146e40f6bea02f956cb4f5f68
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Up:BQRQyi36YOcPQLvw2gAf+PN3pVh
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3dcb36926a3f94cab3147388b1abe6beeabbd5ddb4224641ec9834395880472
MD5 1da32da31a7859c77b0cd3c5199a76e3
SHA1 372bb895c72bdafc1f63aa8835c49af2b4926274
SHA512 e534a0faea903952d11454b4054b0300e44d53ec79bd93960e8b5d79b1e62e87afb1f167d4e3c60aa96fa378397aead9b67881340bc4f20a5c593b59eb202106
SSDEEP 24576:5wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0uSnnrFb4PM4MYgv:l68Qg55nhheWu7PNU3/qj4MYPVyGLE
TLSH
T162B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3d41cd9ce9c6c23e8341504e14d63c06cc99df58b435ab5978553e3f5f9271a9
MD5 dfa507212d351c58db6093b17f8f0b98
SHA1 f9c879564149d2042c4f67e309dd3028de5f42cd
SHA512 1c84f5f3231246fc4e09931163c96489b1db4cee860d14f85d7003c4c4771e006809edb2a2c1caaad0848226eacf97ec805a4fb0cb93b7ee11c25970fc467d82
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:2y5112gYy5azzVvL69nLKnhZ+VV
TLSH
T170167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d33354093bb4805f30d6cdedddacbe0f95799aa060cbd71b7666e0f242d1c42a
MD5 46eff982396d9e7c3274c77180137a06
SHA1 2f5cf1b128e5281226d973a51c0e5891849e2084
SHA512 f94839ce7d34f80fe7f3a6624016c189fc485fe24f207705762db7c3b496c75277bc9f3fc9d7cb1481cee51b93d9152a6a0db6ae3c3696e0748de98a5e90f25f
SSDEEP 49152:jB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkj4MYPVyGLg:Vu6JmVxd2dhV0
TLSH
T114D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4313b27ef9c9b1902170b40b7613a2f61112cf5a16ad41c0f4114eda9422f99e
MD5 1dcd26fa34665a09d82b0cbd3aa61293
SHA1 4390aad21edc57c332dbe20cbcd435d34e4d8ad1
SHA512 258d972f5c568eebd0d80e2740c1590d9379bcdbc7cf1f7e2027b86deb31d6bfb8bb8295ab27397864fd498a1e9bd86f355dadcaa1b7ce4e5e41c2e54fbdf49b
SSDEEP 49152:x1hpsNoJpF1A6UU44CwH7R4xgj4MYPVyGLf:xmifPbRsV7
TLSH
T1B7B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7343c76243881dbafc8365ebaa6d486e3bd07b8642fa5d6ca9d1420300a79bd9
MD5 7a69739a199971080604290df0485100
SHA1 b68167186a63e7bf17f35a2c7a170f5b410b1a61
SHA512 d55d0eb3f583553fbc4922aa40cee3c45d90ad6333325aa7c8dc3f096500f405623dfeb1fe504a6506b7677ac2e7b6f7e5d052a2700574f4dd56f0c13e223f2c
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqZj4MYPVyGLg:/5dKTi61CVM
TLSH
T1C4C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eac5eb4dbefa3b9d2afbda552d901e9799a6ff4bb0f339ec24e04edfe416af23
MD5 0c55abd21ed802497320bf2408aa4132
SHA1 8b3974ac76fb959fde834c65985b9f3092f49317
SHA512 de455e0ba3cc9549d84487adb4ee934f2071a2e4bd6c52e1f709300de9e791afef8aed54336a96e69b37c502692d78fbeeb9493c6c2df3fb1cdc69722002e947
SSDEEP 49152:ZhtSn8EApI0figngiDn0AP5w0j4MYPVyGL/:oX2iyph4VL
TLSH
T10D95BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 606e26ecda51efef8fc3074339128c43804b065ac073d026afca5db096111e42
MD5 d6b406311c599e966f2c5be6c6d94ffd
SHA1 671477e9772ce5dbdcbbd9327777f4946a88cfeb
SHA512 8b15f0c6e0a80b35b07d7dd017ce0d8db82380910b18da4d6ac692b18e1f08a7d018f54c19a11148701a22df0f340fd5d0794e44abaea760276401847289a043
SSDEEP 12288:PV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:PSSnnrFb4PM4MYgLxEVyGL7
TLSH
T1D74523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4054bc3c62019d634efadf8b7a72313b7dca52ed738741214bef3bf31c840df4
MD5 7bd9896b716f563276256ee9bf7abd55
SHA1 b7689cd787b4eeb8ef0047a2cace166b208de8df
SHA512 d5ed382c8fdeacdc20495bb29a72dcf51fb8516849f5321a4f6ed518c56e9fb45d42a358df4c9a68c8069722a09eb5eb11091a55f728d741fa111b81117d533f
SSDEEP 12288:vO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:vFSnnrFb4PM4MYgLxEVyGL8
TLSH
T1394523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B4474073B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0d3a75773cfe0f0d0e94d2e914f47f17d12cba5ef08d723afdda02fa2e9f09dc
MD5 01f439174265240c3b11f87b28f12134
SHA1 6d6283ff1fc9b8886e1414e4f76c8e3adfc0e550
SHA512 167f240d8e47435b6954aa31937bc5d96e75a1ca682f98714b60a19d939d31aaeb45534c1905f13560a93946514ddafb3c5f9e1f03f8cd5a00fd70e1beb869ac
SSDEEP 12288:/E34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:/PSnnrFb4PM4MYgLxEVyGL8
TLSH
T1C94523A62EDC10EFCF5D06F0C1A656C8E2097C63F976B20F7B8574063B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 2d4779fd6680adae58900fd06472ec51428ccc09e1d0b7ec03b98b2f7d49e407
MD5 8dbec9e5da34adfb33e96f6673c774ae
SHA1 33bf7d5b39eb6bfb85900a6667ab6a551e74f4f9
SHA512 0177fb77a4e8367711fce4bec9a760f16ecce9eba2a1f1914cd01a4d9b4b77820706e551a64755ea9d88cfd8e9d9b0bd07437fdabbb0c1833c57be6a3e6954a0
SSDEEP 12288:yVj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:NSnnrFb4PM4MYgLxEVyGLE
TLSH
T1164523662BDD10DACE6A96B0C1B556C4E2257C61FA72B35F6740381B3F37348AC71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 458795ea6e86cbd44b2a1e8cc866e2573de716b3751fb268e3dabc9a7c3d3b8c
MD5 319a91bca26d1c46c2e51edc4856c093
SHA1 5d0480841dbe71a641d6b66d85051a0c2ceb0070
SHA512 df0c9fc0618f91355e2d36088e95897b872bc591c3ff96a0ae0d9d0e3899e188125b488e7236f57c36c02ba3c0b2e364d68739887b23eee6e1979e7ae26418fa
SSDEEP 12288:xb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:xUSnnrFb4PM4MYgLxEVyGLU
TLSH
T12D4523A62EDD10EFCF5D06F0C1A656C8E2097C63F976B20F7B8574163B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1a60236dec9e718c401e17be88a5509974e19b165503c61c8a502414ef6d882f
MD5 9bd63b46de8a1277292c21bb111ff2c2
SHA1 c1226342959f31bd5c32713c53998f3479da2aff
SHA512 a3ca00e377b7d4aca2dfdc6ec9789c0fb5c29980fe79b74813104e9cc376524e395a95bcdbe0fd7c33fff00bf1fc146537ba43882b71e919eb6cbbbe53c0e5b2
SSDEEP 12288:3a34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:3JSnnrFb4PM4MYgLxEVyGLG
TLSH
T13B4523A62EDC10EFCF5D56B0C1A566C8E2097C63F976B20F7B4574073B3B60DA891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3cecc286b827295a82caa80e03909695942ad95342f68eb4230b80505bd602f0
MD5 d7848e7484916a094e6d2051f312fa0a
SHA1 bbb7edb0b65cb9992035f8d56e5bcae2f52d47b5
SHA512 9625dd6c75d71e37cbc43e1cf85cc30b2ac06eb3b3176541964d6d1f2560603876f855bcc1b6903725089e8a7fc829267f939cef64622cedcaea6622c62b4ac4
SSDEEP 12288:JG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:J9SnnrFb4PM4MYgLxEVyGLV
TLSH
T1504523A62EDD10EFCF5D06F0C1A566C8E2097C62F976B20F7B4574173B3B20DA891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 794727bf80df0e076393b1bfb156546886ff4e1cad2d27cbbce20b8a74739429
MD5 7248ba115507c02e29c124a67af0c818
SHA1 62d41efe92beef7c1c6ef976ca78527df6e02b0c
SHA512 f04de5a01442bb8ec03829b8740f2ade7fdcf2eba9c4d748f84732059c80220cae83c241af6fbe8460e9f3ceb05cc6e72fbd6f5f5731901973c229f19e3a83ea
SSDEEP 12288:0iZwb6zzFEoS2cPvyu34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2j:XZMSzFVSOlSnnrFb4PM4MYgLxEVyGL6
TLSH
T1B76502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 05944a0a40a04f35e27d354a75df26169d7247a6e6da5de5f8218abf1e104c13
MD5 ec87d6e996961f09532cefdc36b404a9
SHA1 dc597b600ea35468facf867bbddfa21f42f5af49
SHA512 b71de4f87db25260efd52039cb25afb1fb2a45940040b53a715f01923c9b1e3611dfce2b94916c6fd78f87f69b0cdf837a9f6a3c455acc4305b2b5493d1a48f7
SSDEEP 12288:7J34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilW:7OSnnrFb4PM4MYgLxEVyGL4
TLSH
T1D34523A62EDC10EECF5D06F0C1AA56C8E2097C63F976B20F7B4574073B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 df54769fd251baf56fa7d097b0d4344f5ae1e2181a6fed4a90e4f3c7fb0b8b76
MD5 3e05f1afd44a16d7eb3dfea2dc19e573
SHA1 828b598418658a159f0517b94462d082f5e4c48c
SHA512 e9ab6cb98127df5b9f0ca605f5ee901ed7f32ab7a39133433c40836e16cf891ffa6823120903a9c7e2b9f81a6092c0863b5e5011d62e4de319630c373a3dfc29
SSDEEP 12288:y934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:y6SnnrFb4PM4MYgLxEVyGL2
TLSH
T1F14523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574073B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 e01aaf760fa4360247183f36cfbb4b5d56435cc3d092fc81dccfd2b83f7b60dc
MD5 d3e6c0e2733f01230682a6ca4f2a2e88
SHA1 0ec7371d0b014a1e8033c9970723332079ca98a7
SHA512 041c96574a050ea22cccee431d9b9c4c73c9baa616ea88bfe1b192eb34327e4a66b43376cfb5a0d0417444d57b2d5074d4186259cc806cebfa0699b6ddd4a3ff
SSDEEP 12288:NyPz5L8C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:kzyRSnnrFb4PM4MYgLxEVyGLu
TLSH
T15955025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2a14890694e5d5f534994db67ba88f664369583bd9fe207ef8b6f71ffc464134
MD5 c827c5c49f11be284c197f7f356c26e0
SHA1 491bc186820b41aa19e492d6f12c88bb2c4ff427
SHA512 80cd18adfbb29fb60ff81b00c8b9518a6ec08c47b2fdd719096b57e0a942d174169f26289af2dba94de76fbb9d89b83411b66ccb754eae873a85f486feb65257
SSDEEP 12288:HJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ill:HOSnnrFb4PM4MYgLxEVyGL7
TLSH
T14C4523A62EDC10EECF5D06F0C1A957C8E2097C63F976B20F7B8574063B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 637c3a40cdc5c19192d4ab7a5c296b2ddf8e95a4527dc53bcbd50908f2301b71
MD5 52432708122ccc14bd64923492e2a117
SHA1 c347d29e0bdb002994d6d7d67dd94fdef4f9180a
SHA512 72373073684fb47d33acb7ca201d4e0dc7cfb6a0c389548579044e5be7cfbe8338f02e12373aead98b3b521fb2c56661f9ab174b71d6628ea4b9108cd0da59ae
SSDEEP 12288:UJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:UOSnnrFb4PM4MYgLxEVyGLx
TLSH
T1CA4523A63EDC10EECF5D06F0C1A956C8E2097C63F976B20F7B8574163B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 8b6b82947c838b913817eb6a09e6438db8deded68718a5244cd45679a621ceec
MD5 566b093360a4c32dd85f03d29419ae7e
SHA1 a1bf95946a05457823d1091eb7d0668871ffbc52
SHA512 6b2801d6c4049cf70dff4b2b343c905ad1d2691828e5ecf21fdb2f89902b09cd290ebc4171938cbc216915a8ce886fbcb1fac0dcaea32b0a3589cea86e025f6e
SSDEEP 12288:TyPz5L8C34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:ezyRSnnrFb4PM4MYgLxEVyGLM
TLSH
T19E55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4e553991e4add41362910f91e4026b45cb16aafb9b528cdf5e40804d5b846921
MD5 50819b5ad4434a21c97c01ac9ffb7407
SHA1 66347e8957b4d92353285592418f2b2e4e27913b
SHA512 b1dd86e4965b701e3e98165dee9ba0515fee5aa11dc0866c595d02e7f572e6eba1e922aa19f5b8f328b387a43a1105f01d8e0bd97da28568c0de261ed76cb3e3
SSDEEP 24576:VTHaLl3z0zD/SnnrFb4PM4MYgLxEVyGLZ:VT6LljTj4MYPVyGLZ
TLSH
T1AB6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2add1c25dd6e7512c7aad4cae090025d81fc9b5e434c257c3dbf7d94a87abc50
MD5 fee6b232a07caa9535b82e862702c2c4
SHA1 2162d9f565f1a7ee0f90a926e458ad5985d1649d
SHA512 12e73511a56c3631ed3393a48f91cd41e6cf41f97d5281e92954a4f2410750c081f3eec38b944f6b3e2f6d3bd36ac421265be49207b6f93b72d8158a8295064e
SSDEEP 24576:f37d9CHKy7GZTSnnrFb4PM4MYgLxEVyGLT:v7d9CHKyaSj4MYPVyGLT
TLSH
T12875DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d6feb8b8269b1bb8e0a4ca88d0d5e537b09420b5ecc900575ae4314894f0e730
MD5 50c2a6c87f52d37c0918d12470163d91
SHA1 0337e256d377dadca7ffe62d5dcd6d4e1a0aae3b
SHA512 996ea7498599d47e06eab57826228cb8365b5149d48d82605a287743fb626f3f3b6192c1575d3c45bc4d7853e3ccb4e8f1ab961177d054c69ed0278eb444f8ae
SSDEEP 12288:wk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:wvSnnrFb4PM4MYgLxEVyGLS
TLSH
T1304523A62EDD10EFCF5D06F0C1A966C8E2097C63F976B20F7B4574063B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ce7515ccff762c7dc0827ccc42ddf53d258edbd328d4261e6d17625d88eb4114
MD5 32c26b8d4d540e08cb5d79d9c84bb235
SHA1 239938e6a447ff8866a1c7e86e8c5e8a2b866f25
SHA512 cc5c79b80fd27b2f564199c6f2894158aa0fc6c35f209344f4114457eeaa04dd8722c8d6144f6dd845730fc198da7261e57f24ccaaab539275bea84b17935320
SSDEEP 12288:Ti34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:TxSnnrFb4PM4MYgLxEVyGL2
TLSH
T18C4523A62EDC10EFCF5D16F0C1A956C8E2097C62F976B20F7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4a66a9b31f6c5b8bb208facd2a4a105de13fca5eef63666a2bc5a9afe96b3572
MD5 fd254ba82f7feaedd0f9f60f94d24776
SHA1 fcae226ab1d0db9f95b6914843a6d433680d0b5f
SHA512 23ef96451f359a31838f1125d106d55ed7eb15ea881fcffefe5e4da84716d81db12911b1a5c89469e8269f0b56ceac27b2f52fdc92c262b45f3266e44678b908
SSDEEP 12288:WX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:WYSnnrFb4PM4MYgLxEVyGL1
TLSH
T18A4523A63EDC10EECF5D06F0C1A956C8E6097C63F976B20F7B8574063B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e6599e7ff37f07ddaa80ded1ce61869e1f7e3e993f85f0100acb9d4be1d8b275
MD5 dbb15679b1746eb393d78bc1066d8743
SHA1 29493018fe3a5738ccd4b7784df139e3ee17f6db
SHA512 3ecbb25a8f3a8cbe7cc35c25bce835f5f23613a8087a05615611a1cd587ed1b73039019287b1836d5ca67c8ce18cf15f9f833e894cef5525b7ff8a2e7a2fad8b
SSDEEP 12288:OJ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:OOSnnrFb4PM4MYgLxEVyGLc
TLSH
T11B4523A63EDD10EECF5D06F0C1A956C8E2097C63F976B20F7B8574063B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 74c8c14610295658e39936bb18f60b6ba2c9838ed05e1c056413ae5f8986e4fb
MD5 ce02dea55b33781f650cb6aa12cd9b4c
SHA1 b450e0dcb912007c4e6f8ddd52a6a45703aed107
SHA512 a5275a9399f0f8c715ce2cf3898290a3208b13370ede075429b1d6c1e9621d0fe7ce86ee765baf0ad4963dfd171a5b0b1947fb182f2a4880a0420ab4d503c8df
SSDEEP 12288:tk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:tvSnnrFb4PM4MYgLxEVyGLi
TLSH
T1224523A62EDD10EFCF5D16F0C1A556C8E2097C63F976B20F7B8574063B3B20D9892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 31ed69b55772bc2e0b00c1ae3f76ea626d2a5c01b4ea420fecc8131b957c97c3
MD5 9ad6a77123d2ba481d0342cabcea1789
SHA1 1800f74e99a8a087a4bf8cdc4ca94a1b7ee32dfd
SHA512 2e5966d7a3e147b92a3cd44eceaba1dc212a1b94e66868466aef143a888ad2538bb16019402cf09968fe8e5ba3cd0e4634e0ec6f0198f5038ca4bc634aa7c31d
SSDEEP 12288:NB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:NGSnnrFb4PM4MYgLxEVyGLr
TLSH
T10B4523A62EDC10EECF5D46F0C1A957C8E6097C62F976B20F7B4574073B3B20D9892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b6643b3a58285063bd247cbf5465655fe6c74fbfbd40d3b53bbd39cc8b13a5a6
MD5 ee0c5965345f3656941b31bb2fe7bc83
SHA1 639abb3505d26d15e8b30a12c303a8eabc0f33d3
SHA512 33a943e98937d1980d1ffe25878445fa4be0a01950fe3cf2cf531d51422c25c0350d033aa8449d0addee13a908c1aa01858111bc8d3661b233ab8753f4ecf440
SSDEEP 24576:Dfwvok9RX6wkyAIKSnnrFb4PM4MYgLxEVyGLh:lMnYIFj4MYPVyGLh
TLSH
T1CD85D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d0b482650a29f11f1d90894c77fc8e32b27fee9be74802434e2a128fafce7ed0
MD5 3de0359ac6fa8aaaee6a803ef94e1d1c
SHA1 67eaa9d93c8f40ba2377126c4ba15abd21a6c3f0
SHA512 16c026ba025e587da53652a5096cfcd690a6f8af1b8dffd8f9e97fcb45bfddcaeaf2b5dc5b8939e467217afe7f07e9cfcb817fcb8e8a8765bfd8d2ca952f2557
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Uj4MYPVyGLp:NySzPJV9
TLSH
T15A066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0912f8f7b55b02658d1d50bb796ad6a7611788d77859d79c7138552ed20c1e5a
MD5 e7f0932a6102caf77bbafba4fb9a8e1d
SHA1 c8f2db3937135a4af135bd77a4a9a3cd46badd3c
SHA512 b9a8413419e73b13b4674ed4842228dbb7302c6239fff55dbd6b9a64c6aa17f856bb76aeb0c3b9d65ff0c00697db993142341e672849fca2c94886b8fc6501ea
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY1SnnrFb4PM4MYgLxEVyGLu:h47JUQj1irIhCnDHUPfF/kj4MYPVyGLu
TLSH
T16065BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 20ad8244bb25677ddca47491ed8ebb55127aa2eddb1f93cb65e73195bea7d0fe
MD5 8b8b2dba7768a41c23c762301e82dcf0
SHA1 0f4b098007d58af1becea8eb463ee09604b3fc66
SHA512 57c367462d6c923c1daa366412c6e8d470a5cabca62a7976a36fcc8ccfeaa04cd0c0718e0ba0f5b95382f20b70150783ff15d487539a4b74d57749847a6e4812
SSDEEP 12288:hNsf534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:m+SnnrFb4PM4MYgLxEVyGLj
TLSH
T1A955F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 896KB
SHA256 664763836f6da4c4e49b9b537d190b8017d8fddcfdabea8341e578fd1667192a
MD5 06799ab37562347f8498aeddd99286c0
SHA1 552231afa874712becf83a1110a8bdedfdbf74f8
SHA512 920f22f2586b19612b76c3b7752021624193f63ef2f93cc59a5d248b9e87d9227e6fe3c2287e11580aacc608f8c49401cdbb12c389df1c3c48cfd1605e08c6ec
SSDEEP 12288:RwhxyU3fiU9yjRGao9G5stq30qxtJf4mvux7aR:RwyUPOtIO+qFtp4mWx7aR
TLSH
T195150604B66AC75FCA6940321E36D1CCAB707D11EE446F0773C88B3F8576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 309KB
SHA256 da59f50cc026ff2a50f725cf247e3b6aa6f6757c35696a6c6b94302556eb03e1
MD5 5a75180ffc3d5ef0226fea70aed50508
SHA1 a42adec11cfee70dae9106342b641835d59b9a0f
SHA512 9ec9bbe7048b3c4f23f27a4bdfab259a219f22462f23e7999739175792b26902a6c50b5f06a99d7bb063d8ae4a611514b685cb8167b47d404a9bd16555f978b6
SSDEEP 768:9/TIZlTPBlTz2+EQM6/ThyerZlTPBlTz2+EQMg/TQ0z+alyS+eZlTPBlTz2+EQMF:9PNcJgfO0I+nr
TLSH
T13C646111B714E319C47A81769CB0D1ABAB39B026CF2353433FD82F5ECCB22563676A65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3e9339b42718cf48f9393e97c331ff2a2a63967cc10ca17fddde2d19d7954e61
MD5 ef10494adb06038ad13b0e3d2b508c9b
SHA1 04e8cfc5f90a2103bfd8bf392eafbb72032bd4c1
SHA512 80c5e9dfeee9b1c5dc898405e9a3d7b22cc7f45ea0600b8710bb1e4b1dbc012eb8ca57e905ce585c0c61ec8868a92f995c21ae86be0535273308a37d6596fd03
SSDEEP 12288:JM7x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:C2SnnrFb4PM4MYgLxEVyGL3
TLSH
T1184523622BDC14EADE7D16B080A99698B209BC31FF61F18BB7407446363B6CC9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5ae7e36d19a435b0ba4e0c252667db5b5d6ab770bc5b0a968515bf2d43eeb4fc
MD5 70f052a962827515ace7d9d2c8a9d2f5
SHA1 ce94400bf782b4b5d09584a638c71ed8aea6c335
SHA512 2dc144f7adb92763421fd74a9b591f89e7c811ccc48e211a1f759797ff0fb47ba599fb2e0533ee36fac419712b29474b24e6e00ed6e88e390558923448c3c078
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYASnnrFb4PM4MYgLxEVyGL0:egb4mBIBhGFOj4MYPVyGL0
TLSH
T1AF65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 50dccfa9c753538f592922631415c5c7da4bde5cfbf773f33aeb217595df54c7
MD5 9ac23b216ad2f59004fe4b2de0fc8e67
SHA1 e9de5e7450bc1fa1cfd7210a6f049bc6dfb3dc84
SHA512 9df2ccca9cadfada573d58005683d732c8361cf478f59db288639403b622eab4e651b0c48ae1751119d1b52ba72c7b8ebb745ed4f3a0dfec3c909533dc4cedbb
SSDEEP 24576:rG88u8FpJqH1bzria7/mlSnnrFb4PM4MYgLxEVyGLu:q7ZFPqVea7/Lj4MYPVyGLu
TLSH
T18085016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 72f36e1e5ed68987028865a9fc0c4c1c42c7430e9ca86c2b597392918938e3e7
MD5 aa602167f3efdc7189556152b79b7ed9
SHA1 ed58bf2fb0c6bf3c85493165002aa420bc9e4e46
SHA512 c06d75b4e87c4f97f62277fc6af2b7b7a9d2f2461f55e68a4938cef8e6387fed49ae60db2d311927338349104806c974f8568b0375428cf29e025d08afd67bc5
SSDEEP 12288:8HvUrBFrEjwaQq34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilu:8PUr+NQZSnnrFb4PM4MYgLxEVyGLQ
TLSH
T1C765E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77b386398996a21e2a73b8cb86fcfe85c68d10d84e23def7a69e9563f3907f8f
MD5 74e1a83bb91e3d898ef99e485aa6f42d
SHA1 8a9e43429fec1aa464b44a4d0f089dac9f324f5a
SHA512 0f141276794744bf2deddfb4e7f09ae12f8be458cc375adae1c21969a24de17c6d25e86883ef7ec7edda537b87a121d1b2e54d8f96e1bd2d9f6393ac4995b485
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCj4MYPVyGLS:fG05lO43bmV+
TLSH
T147D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c0ce57ffd15100bc3806f1756c2c28416079be0c0933587eb43b5ad63c6f82e3
MD5 9cc4180c7ea95693f52c0283dc9f08e5
SHA1 684d77ca4f56fcb62421ee7448fa5447b6a0c1ab
SHA512 632f24738208b2842d8b79dc293b964451ca672a3e418a2b76f6de83ef80c3973d8a98e4995b5671d305a6d4f4310f59f057b0d7902cef1804593db7ca86cff0
SSDEEP 24576:tfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnLSnnrFb4PM4MYgLxEVyGLv:da5POZ3+Jt2pasx2+mqj4MYPVyGLv
TLSH
T19C65AF5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3974fe968003f3cdb6d465afd13251fe6a306e5d07afc7a4b591f8b3741a8ecf
MD5 9941afaf620947749eab871c276513a9
SHA1 7ee31e47d0356f39ead2a7dd82e723df1fe8e59d
SHA512 0cae45835ff1daaeabe2236b7f73638008ad52fa8a0a117f7aa5af92bb95d820a644ce01f36bd973039397e87f5b77460c695aec41eb1d280a17aea835232c0e
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7FktSnnrFb4PM4MYgLxEVyGL3:ANc/zEOVHFrj4MYPVyGL3
TLSH
T134858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a89aa557d4df046e840959f6454c28d94a9555690efaeee8c75f6e2462a18b96
MD5 b439a9cd6e5076fe74e82ae0a8618eb2
SHA1 df400511bc2174f0e16eb35d052540a13aec05ed
SHA512 3f0ced4f0a595151301cdab58a373d8b422f5736db106a5e57dab61d276cd9ff6185a53b0cd92eeb07330e36c2527acccbc781ebc85ae7a7d71fa9e7d51536f3
SSDEEP 24576:x8kNvNnaFeYhJNtmZBmXSnnrFb4PM4MYgLxEVyGL7:x8MwBtOmQj4MYPVyGL7
TLSH
T108559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fc9b69385d5c6b00bee6b795890653a5f273b60c8b2028ac8fc437360a8629b8
MD5 2fe74e83f4d8b399c3cb2714f1c1e26a
SHA1 12ee62b37b21d030df424f2b457b159dfb999116
SHA512 aabcd2a787c817d8907252cb76c3bd9646d17c9f8a210742ff3a1f56dbb032e27ff074aeb26731a53919fd787db5bb1221e1e8894dcda90beaea57cfde133481
SSDEEP 24576:oD3FHshBIYQgAySnnrFb4PM4MYgLxEVyGLs:oDVHeBIAAtj4MYPVyGLs
TLSH
T1B075E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1404-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1404-184-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1404-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1404-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1724-346-0x000001A61DDF0000-0x000001A61E470000-memory.dmp

Download

memory/1724-423-0x000001A61DDF0000-0x000001A61E470000-memory.dmp

Download

memory/2084-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2084-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2084-143-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2084-146-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2084-148-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2844-355-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2844-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2844-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2844-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-357-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3204-84-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3204-76-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3204-304-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3204-78-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3424-322-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3424-117-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3424-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3424-325-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3424-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3424-111-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4720-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4720-327-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4720-160-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4720-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4812-319-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4812-88-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4812-89-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/4812-94-0x0000000000AB0000-0x0000000000B17000-memory.dmp

Download

memory/5328-124-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/5328-0-0x0000000000400000-0x0000000000642000-memory.dmp

Download

memory/5328-1-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/5328-8-0x0000000000C20000-0x0000000000C87000-memory.dmp

Download

memory/5464-287-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5464-65-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5464-72-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5464-66-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6276-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6276-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6276-152-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6276-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6320-132-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/6320-125-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6320-126-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/6320-323-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6400-57-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/6400-51-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/6400-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/6400-61-0x0000000001780000-0x00000000017E0000-memory.dmp

Download

memory/6400-63-0x0000000140000000-0x0000000140214000-memory.dmp

Download