4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Size 8.8MB
Sample260706-p3wfjsfv5s
SHA256 4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df
MD5 9e48a98392addce2a6de23781775f8b7
SHA1 3266b486e010cba585f37bfc5db91589acf8b6f9
SHA512 43c51a5cbd344e87b63c7ab7cd9de3396cd1f502106dcff785fd526b9b97d1bc603ccace8dd0fc536dfe62758a2c8b341d59f66568993c8492b59586224a65ea
SSDEEP 196608:AjRorQYdrIShQTReTRIq7ZwG5eWWi/zio/iA:AjgQ6hXZDwWrX/z
TLSH
T16E96E022BA868171F9A20172967D6F7F487EBD31077880D7A3C41A1A1D712D37B3A793
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5756	elevation_service.exe
6496	elevation_service.exe
2172	maintenanceservice.exe
6964	OSE.EXE
4556	PerceptionSimulationService.exe
6600	perfhost.exe
5928	ReFsDedupSvc.exe
3632	SensorDataService.exe
4720	ssh-agent.exe
4748	AgentService.exe
2496	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\U:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\Y:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\Z:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\K:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\S:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\X:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\V:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\W:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\G:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\I:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\T:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\F:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\Q:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\R:	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\locator.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\msdtc.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\vssvc.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\AgentService.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7f6ec58a8ee34577.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\GetShow.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000134e43a460ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5f9a03b460ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000044f4c13a460ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000816d3481460ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f90bf3a460ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe
5756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Token: SeBackupPrivilege	5928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5928	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4748	AgentService.exe
Token: 33	2496	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2496	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2496	SearchIndexer.exe
Token: SeDebugPrivilege	6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Token: SeDebugPrivilege	6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Token: SeDebugPrivilege	6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Token: SeDebugPrivilege	6636	4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
Token: SeDebugPrivilege	5756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4240	2496	SearchIndexer.exe	100
PID 2496 wrote to memory of 1332	2496	SearchIndexer.exe	101
PID 2496 wrote to memory of 3156	2496	SearchIndexer.exe	102
PID 2496 wrote to memory of 6684	2496	SearchIndexer.exe	103
PID 2496 wrote to memory of 5564	2496	SearchIndexer.exe	105
PID 2496 wrote to memory of 1048	2496	SearchIndexer.exe	106
PID 2496 wrote to memory of 5568	2496	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe
"C:\Users\Admin\AppData\Local\Temp\4ad83daf5165924c8c2625e3ba8d7920fe9ed3f3ead1af2ff16b63b3947576df.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2172

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6964

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6600

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3632

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1935666426-3801330415-1166019131-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1935666426-3801330415-1166019131-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3156
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3000 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1048
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3000 3008 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6ecc939306435f47840a4526dc8a699b40083bd70d25f3099daa4cf83d590d67
MD5 763e8fea81314a3ba9cf377dff454b06
SHA1 8f8bd6d0d9a6f9092c2e0331b0b1277f16555711
SHA512 3108c98a0514a31467bc8931ca5b671966ea94163cd0c311efaf459c462be41c30dce7f40a9ef8fec7f52f55f4bd1b838aa7ca80e453cff196321002ca1e0842
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/j4MYPVyGL0:Z3q6HjBrVw
TLSH
T141D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 25b132a2ccafe96e3c4ef84f92e7fde77d7b011697c56eedbe8bf98b7b1c7361
MD5 f87f41cfdf838d3cb33d257875c2f30e
SHA1 bcf773c664000af9c436f4ca491c461b6b45b2ec
SHA512 961888191a4c3484fc9511a5c91cec5b75b3b156645dc9541a7e87150e74e4a2183dc867dd0ecd9e2eda0a2fc72bd6a7f456bd17b3b08db2fbe19df5f37297f4
SSDEEP 12288:41XLsswWkxy2lRq2czAm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9+:+XYfDtczAdSnnrFb4PM4MYgLxEVyGL8
TLSH
T15165F12977E408F9DD6B8278C9A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 aedac7b450be9e9f488ec243a513e944a2fb0bd98d2cdc3e6abdc5d8108e8c71
MD5 14b964e779f088524d1040a6b9ab8003
SHA1 ba673d69efb17d66694cf020216e1bd0e95a853c
SHA512 13aa3965fffc03e51978383ccd68a5047b6cf399cfdc990f91bae0af3d9398b182e06496e08f85f3fe91997347942c1d63b1bb4857dc76235e5ad173a3f3d4c9
SSDEEP 24576:q0Le5ji0hmxirMUSnnrFb4PM4MYgLxEVyGLR:qPji0Acgj4MYPVyGLR
TLSH
T172859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c5dbb849773402713db8e977bc2948c705c41364b57da38aa5e5b267faebede4
MD5 1fb52845e7f53a19407264793dc502f8
SHA1 77f30d29cea0da8337e5d0689ed98d5084c1478c
SHA512 7eebe75c5f76394ef8c68825a7958122326ac158ac5db1ed45254da61e4aab60f5f848056432ce86c9fa64b232898d0cab0f8b29fecba539d19ba60d7d05dd48
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWE6q8wyuaSnnrFb4PM4MYgLxEVyGLy:4/ezSC6vUzPvxHjycj4MYPVyGLy
TLSH
T195755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c29e34aa8bf10dc47c322b414c73d3a48920de6077cf8dd279101bd4f8c7710
MD5 4375fc0c298bd0f59c7ff3e57634bbb6
SHA1 08e4e233d50eb5ff263acd0fc13c64b05cee5fce
SHA512 7518a52a4f097d2bd791cd75e13d5f88ba3fcbaa0413e8fbb0d3f79331d4d3927764600e6afe67645eb24b0b5e80d5aedaa1460b6776bf6372f50d39dddbc1b0
SSDEEP 24576:/VbqPb88hv/l+6BSnnrFb4PM4MYgLxEVyGL1:/VO88hXl+zj4MYPVyGL1
TLSH
T184559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 440186c1a42e636b0234d4ab9fb5d475cdd44ee58a2c09642f16b50dd67b8e50
MD5 5c7ea01036327307785025a38695bcf4
SHA1 157281ba2a5e69fad058d10cb700c44521838d3a
SHA512 9f8a60933786592f8735048130d62660ee06c86b60a4f11d9ebe4cb497ec8835275d5070e8f85e511b20770bc8aaea01b380325c4b08cf4ebe220a9a907023ec
SSDEEP 12288:kRX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilL:kRYSnnrFb4PM4MYgLxEVyGLR
TLSH
T17A4523A71BDC10EACFAE15B0D1B96AC8E615BC61F875B20B6750785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ea522906e2acb75f785e5ea813de1a0b9d083001133169513833ec4a6459e4b9
MD5 c9479f0a4826a45f462a84a092d8a2a6
SHA1 2809f37af287b3acb10b5cbadab9d72f75d3197a
SHA512 b2ab415535a04f562244e71361b54902daf9dc02e8468cad981e70e0d4fe1933330db037c055ee7d6eb77596e2476a59e90a92205a43433a4cfa02f3aebc67b4
SSDEEP 12288:qeBNUbTVO86U634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:qJIUpSnnrFb4PM4MYgLxEVyGLz
TLSH
T19465DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b5c5517913a60c78cd37cf8542d8c4d0cd9cd835345ccca7804b9526177e3241
MD5 2d839057ed8885177db09f0814a7ebef
SHA1 ed16c13dd0b0430951b679e36d254c63667f40e3
SHA512 1ce83db28b4124405686d9f42c4446304bec15a9db0698dc154d3e16b67a366ea791f14605fd69e97726ef311a28da8d5f9eca922746bb838ebb4c77a0d79f25
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:wQvGAdlCEL8c/yRNw5CeVA
TLSH
T136267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a8c3b50aa046ca3bf370aa5c81490c7dacab1990b17bbdf6fd10db9ab84db018
MD5 25d0af685b283558f46d4a1771b6ba13
SHA1 72e122dd708b0923324fa983728db59ab67e5385
SHA512 9926452e60075062c41ec69b97db9bc0e789025c7f31213c12841cab8bd5cf5fec8d08fc78007bd006d211c4b0ff187446f0ecd459beee77dab08493b350db4b
SSDEEP 12288:OAwSfxL/2Dc34DLLmt0LDQewsAjM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAU:zdewsAjXSnnrFb4PM4MYgLxEVyGLr
TLSH
T1DC75E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d4406dba1ce9e230486e72dd587979f3c35d3c56d20ae43ca1ac4b8bbe9162e4
MD5 cd2ddea4e07695c914ae71b1f421d77b
SHA1 bd89733f99e1fb79b59dfe97c81a46f056dbd758
SHA512 ba65b6878df7da98ef59bae535f44a18a47fd2761b2ec72aa7e98929525ebaf9982cf89214e39ee8f1918f97b82c125ad3ad0dbc0a889737506c3c9bbef5dc12
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:aUEtQevvqc2W1cpV2EI32
TLSH
T1DB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 26b3366636a5fb5bc8d6fb45dc4573dde4553c8aff96929ef1faff5620bea9f6
MD5 a98874238c980dc370567b38efc105a0
SHA1 e9c365c154e5671e452dce2e2b7da179d50dbcf0
SHA512 309daade2ea3222230666415bf42a5b12525256de949d9e899bc84a65eb394f5e0421714b0dbd22ea33a44a0693889615692049db1018397ea17879574306492
SSDEEP 49152:DCbRquA/m2yL5zQfFiV+XenmE3/zwj4MYPVyGLz:8oqtVjnmaV/
TLSH
T172D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e91e6db666d61d215dad585f21a48dbe4d8a4b6c5ec6223050943efca6533db9
MD5 566c49e0d8f6b48e4f5c12ba8c137288
SHA1 eb07e57c3ee34273472ccc0610c42568f04382a0
SHA512 fab63d5980dfd2dab6dd70af189f54ec9915710b5474f800252ca1db6bb29a30eb94c10497dec3b2c6990496ffb3503030eeb3b098030ebed9203a14d079a143
SSDEEP 24576:DAhGLJIFoiwtA5l7S53mSnnrFb4PM4MYgLxEVyGLU:DAMyFoiq5Rj4MYPVyGLU
TLSH
T1D135AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 04ff43a5ab17a367b093f5c663c38dd90a8e967fa27d234c0cc5f24c2ae3696f
MD5 052825b46c93eaceae0158d3c599079f
SHA1 79fad96aeed2ede6f540084db964472f484fb50f
SHA512 1a7e5b043120126fd0e18bbca3be1402a0a29a6b0ee467995d303d39c41473f03d028f2cc7933880390be8babb54f0bf8d4cdf9c45d5fa7b4534c409e077a936
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+C934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq4:owuoOWzSnnrFb4PM4MYgLxEVyGLi
TLSH
T1AC65F14637E81CF9EAA74238C597C535F7B2B8122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b4e0e797bcefb9fc9c1543ea6ce5fe285fda5d7c7bc2d52955fd067ccd817b9b
MD5 f39db682305287d554a15557a30e6377
SHA1 8a6addb7b5cea38d1399cfe9eb25b549a1ac25a3
SHA512 93b1ffa7b70db7252cf486fbd6b35d8e9596d1f6577d2c424b473badea07958f7825b1670d5d1f4d0837437429a3b478afd4d75927be64126c4ab67c27b00990
SSDEEP 12288:CBZ1Iy834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:sZu8SnnrFb4PM4MYgLxEVyGLf
TLSH
T10B5512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9d6c75b0c784cb8eeda5540b159eb96c7f48290fb0a8574768444d284987579b
MD5 a69970481f0f7bbfb529351c8f768741
SHA1 63d7fffb7db8041a75cc1d33f361d962e7f84593
SHA512 f18dd0841f59902b95b007ceee172ebced157f0d07b759d408815166ebd90b4174634974052dc109cbde137dc732d736c8253f81707b9b228e09f84eb4c08066
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ue:5QRQyi36YOcPQLvw2gAf+PN3/VI
TLSH
T1B5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 710a3c19a91be23d2bd4b0a1bb75d5928953dd0d9c13bed91a645f4b76e51c82
MD5 af58667ebc485c4416076b8481850b6f
SHA1 47192b937895005be9ee3570196c9f104485305a
SHA512 cf3fe5df50d9b8999f5132f14077cab091cb6a073405947d987a66b4343221cb3ef1e2d4550ee4bbbc987706e03c873fe1c7b4a6249f8e54aeafe5ff6c40230f
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:bQRQyi36YOcPQLvw2gAf+PN3/Vr
TLSH
T115667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5922761be5a3cf98d2cf12d68a68434d7fb0f00e83d38bd66f8082298f635914
MD5 7fefad51297e8b7135d38b6122f15d4d
SHA1 a002e08b94db41be769a09dc3197cf632c41c144
SHA512 412f362299656862cb3b5c6f753685b9c58bb92e887a172b0c1463c3d8ac1ca2f52fb49335f7c7818d410446b221a2276c4a9fa47fc2095999aeb688e83c95dd
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0MSnnrFb4PM4MYgW:F68Qg55nhheWu7PNU3/gj4MYPVyGLV
TLSH
T1FCB54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2444345a173f3f8ca35790153e7e626b626c98c9ddadaf96389d69be5927f8a1
MD5 e336b03874d81d0a9e9e20e200af0c5f
SHA1 75f5e3d42f4605bdb1c2f2b179ee2e031ed96134
SHA512 7742bf7ee25a4f234972ba87daddd68d42ab2de8112bebec7d52d919e3bf4f8a4b4a3dd59e733cb5889b65ccf55fd373d19c16b26e865c31a54997f80b2eb482
SSDEEP 49152:R3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:wy5112gYy5azzVvL69nLKnhZoVh
TLSH
T1E3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e24e1464c581274e7b3ab010f53502ae99e9c7798f013b8593d55ef274d98b04
MD5 585c4f2a7857567cdb2f08280d188d31
SHA1 d344f1239b61e1477cf074c346e615caaa697ef8
SHA512 5383fda8893dd27bd6b51a61e6c3b70037b83c62fee1901af63288078607f99e2cf04f1f4527aeb945914cdf98b47c4702c9f2dc1386892423b5770f2fbf6e5f
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGj4MYPVyGLN:Ru6JmVxd2d3Vp
TLSH
T14FD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 03f412157a093db7946e823945b7f4a80c90033467423f26c052f4506cdfd74e
MD5 2798d0a9fdf34860e4a069c21d0c4192
SHA1 3fc2c05a817a45dbfb649202943f200610f832b1
SHA512 0f4bdfa2b69ee5fea2a48338703feffc527b68f29140c8e55d41eff730adee8ac51b748b8b88b6eab237b53a901cd42ba6373cb4cdab11cbbe0613d23a90e951
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xCj4MYPVyGL2:tmifPbRaV6
TLSH
T18FB5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b50edc23e632a963d73ff8f97a1ea34dda9bafc76562fe5636c381a8ddb10be3
MD5 97b03d460c3e0fff9b7b231594cbd459
SHA1 6b44633ebeedcf2376c179ff791ea1ad3c0e2817
SHA512 552928c8917d4459d65340f5e5cfd3bc15d807276fe6adffe48f007c6b18f8e173a7a500ad0785659f18e120dcd422f5847615df203bd3b96bb1fffa5b0a0871
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHqvj4MYPVyGLp:Y5dKTi61sV9
TLSH
T12CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e9744419ecc50d002f34c4aaad4a90de69c3f67e085b71654a946bcdc64d2b3a
MD5 e31c34a916e7f33a375edd880e5f97d8
SHA1 a071c0030f87f5cf2a6f9e8e2052bfd521bef99d
SHA512 20403f9a6f3cfa0c938e0985e956826d1a380100f57e1dc93a73d62ae7a4abe7dd76f09a7277f827e5bd3039b8d2b426772205c9a7217253f8da030e3cabf08a
SSDEEP 49152:ShtSn8EApI0figngiDn0AP5w2j4MYPVyGLB:TX2iyphmVd
TLSH
T1C295BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 52bff5b71b2449d2f6c054d012e6707ef25928bbd4acde8bede20247356f382e
MD5 2a29be85c58e66a0c3e24d449e43f7cd
SHA1 416bf5f9035b64020bded8afc3a6366937696108
SHA512 6b42382f41441bff204a8aa6ef0fc7f80e03600f3fe26562663ec3efbb9d8074c1663afa837d80b8d4213d5027b1117fad5f73eb38a680ff2463e48ea849f52d
SSDEEP 12288:Af34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:AgSnnrFb4PM4MYgLxEVyGLH
TLSH
T10C4523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f36cfb290ebf7862c5d209f600faf2eced8b3c39f94518226be906e2d34dde08
MD5 ffdeaaa9d80bccdcf5720fcf8b5b42dc
SHA1 4e08ef6e82a25e73aa633341b454924ffd57459b
SHA512 09b46780a7f91d4b75a16ee71f26ac42fb0a0e4086d3d7c6a69b2e410770c03665441308465ce62170174dea0c0427bf2da435c48f792f4c4cb1ad64cc9f5ab8
SSDEEP 12288:R434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:RLSnnrFb4PM4MYgLxEVyGL0
TLSH
T1A94523A62EDD10EECF5D16F0C1A566C8E2097C63F976B20F7B8574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6e8149fe77949c6af5c17c091779e921b94d614ee9512f9840ebfa1355fd89b0
MD5 e36373c9ba5ee9d328958bb43d806cb4
SHA1 1443f043830433fdc034b9da4b1bd0ce7b5808a1
SHA512 acdf9d9ef0cafc317c51f81514fa6424d3e7a7e15acf48c4a55ae26675bccc405870c07e7201b5e7078af9902996518b1835d53c2a8b10c7e2ad263f9cdffc7f
SSDEEP 12288:GC34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:GRSnnrFb4PM4MYgLxEVyGL6
TLSH
T16D4523A62EDC10EFCF5D16F0C1A966C8E2097C63F976B20F7B8574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 403908ca699989fe59c02f3c4e1a2b78957b2ff5b3606b3a8c488a42d66055ee
MD5 fe3e796ea826e9af35fbd9515a2ba7b5
SHA1 6f5eccd0082cf848150003c2e5d13bd2e0907b7e
SHA512 3014439c5887daf231f094558a0c873379c47128eeb39c5f7b5ba80c624f5a217aa1280ad290a703199e8d1b5b9b0ba2835af494b0fb512aea1331b4b0ba878e
SSDEEP 12288:AVB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilH:ZSnnrFb4PM4MYgLxEVyGLp
TLSH
T1FE4523662BDD10DACE6A96B0C1B556C8E225BC62FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6fc2b5c56732075104b8e742ee1f7a00232a94a8a5f05dedd7e5af027466de20
MD5 76cce1c6e1c7c1b03ef391db887ae123
SHA1 46d4db6e9fcb51336f5f685f85cb1b0d140862ca
SHA512 29b4dca95a05e54ae25cde77229caf972e434db4bbc1e582ddd5d712be6395a8ad42bdda2e3b6d56b8f07e83a9b93c47b08cd8b4a6975c1f0dc3e01c3e716971
SSDEEP 12288:8Z34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:8eSnnrFb4PM4MYgLxEVyGLI
TLSH
T1B94523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9886e6765e112b26fc955f0e788c27c2dfcb17ac74915dc16702de691a9bcf79
MD5 209a33eafce9520eebaf40f2df6cf95b
SHA1 389278f3e81c44584d748b90110fe2e29dc54584
SHA512 244338ab24c5c2bd221afc3cdf5baac078a107d15b650f90f2afffc1d785b70193d7d9b73f9b364acf440b456e79aaa32ceb1a601776822ee321ac62035abd8d
SSDEEP 12288:H034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:H/SnnrFb4PM4MYgLxEVyGLz
TLSH
T1944523A62EDC10EFCF6D16B0C1A566C8E2097C63F976B20F7B8574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b7c7724a4ff4b4b9de367b3272810e9ea5e88a47e23eff83e8eaa40b40b7b412
MD5 c5856cf92ea89c7606fa9f345aea2ff3
SHA1 d4a94aa3cb21cea072d134eb283e57c2e90d8a1b
SHA512 695fbf81ad88eca10b72d09c44f176589166b77337179f54eabcc277068c14d631ec8a28b960e2f635ad594a39d43b73011998900b19725c94f280244d3164bb
SSDEEP 12288:Gw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilF:GDSnnrFb4PM4MYgLxEVyGLz
TLSH
T14C4523A62EDD10EECF6D16F0C1A566C8E2097C62F976B20F7B4574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 1044b8be89bb9b391377631fac6a884b5b5773a03a17be55f64bc1d683820260
MD5 5da26b4f80b50778c4d85f27c3c75157
SHA1 9bf7db3155f8e88943d2439ea5835f61aa9fc7b8
SHA512 67bf2165eec3e0e930a5788cc2043ca2939d6a1509d48664f2acc2a6d082b30c24622db36c2d9f35c1b510f8811790f8a0584578fe9f520a942ff8ef2e8e7afe
SSDEEP 12288:uiZwb6zzFEoS2cPvyY34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2g:RZMSzFVSOrSnnrFb4PM4MYgLxEVyGLl
TLSH
T1AB6502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4fc7a4608ac259225dddead92f84f6b77130fea4f7901295869b7697753e63c3
MD5 db1774615295f0624be6602c1002ea31
SHA1 4e2071d260d2c381d17eb6a11ac1411db1859c2c
SHA512 fe178550dcaabe6d3090fce720526209666daecaf404f30d3a3bd5e452edfcdab68e68485aff83310e976fa596ed97397ed2578e4763f34f048944c8ea44d255
SSDEEP 12288:RT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il4:RsSnnrFb4PM4MYgLxEVyGL6
TLSH
T1064523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B8574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5a1a32d25d65363e76348ae3fc616a09dfb5f68433274189fde944e668b97453
MD5 058c333a4fe4e17bb88aea245f83df50
SHA1 b7fcf433e4cb9206f1c09947e148aad79a5dd928
SHA512 1704e17ff4613008d23ec5d72d7b2833d483dde8bcec012b2ae00baa84036e8cdeb08f13b0ab46f58990c631dbd5fe80dbc5f8a496bf6731681571c73fc5768f
SSDEEP 12288:xH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:xISnnrFb4PM4MYgLxEVyGLa
TLSH
T1844523A62EDD10EECF6D16F0C1A966C8E2097C63F976B20F7B4574073B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 bbe5b0d499fd785c39b0f800a8d86757a1ef84cfe4173c1ca6adc9778ad7022c
MD5 39a688f960934e6ee21d1b29a8cba30a
SHA1 cc17887620fa3a2969fbc2c99136507b83c54f27
SHA512 1d0ce8c398e1152ce666e710441146694eeb84ad972d6a70f43838842aa5d7ab5e6af77960b12bd21b0be90a5a901a4314ef742bf130dd50ffe9317d557c3768
SSDEEP 12288:4yPz5L8834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:ZzyHSnnrFb4PM4MYgLxEVyGLZ
TLSH
T16455025737A530FDC67A8274C4A21A45F336B8329B309A9F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 edb8f89c2adc28357147736f62b8dce62b0ab65117322930c887685f479a9c59
MD5 521c63812baa9f7582dee55d45fbfe72
SHA1 d1d565f17e378b86364a7a68e468935508a54cb2
SHA512 0bf29e1be609d66b52b786dd1a2433e623c96d2075eb0c1b4a980c0cb3bc4c2d406dab295767818607168967d99b7161260a715ee02940e8ed076a406a70b505
SSDEEP 12288:yT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilV:ysSnnrFb4PM4MYgLxEVyGLD
TLSH
T1414523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B8574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9e5c5ad40d069ac99f46ede79dc2c200e117528787bc8e3e846ea238c63d2cd4
MD5 25f68218ef053253930c4fcb4fb6663d
SHA1 d1cabce141669423c09e592ea8b9440397b30560
SHA512 bba4a677ce30ce57c15e8bc116eea21acc2733269b95afe9e05ba52aa74b926a7c2584909fb6f52dfdbdf2b5eedbccd9406a1ee70deca7abbe6a41695f20138a
SSDEEP 12288:UT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:UsSnnrFb4PM4MYgLxEVyGL3
TLSH
T1124523A62EDC10EECF6D16F0C1A966C8E2097C63F976B20F7B4574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 022d2878ddbb0534e3272a6f32754e3b3cea4fb9078cbc6f34284a3f761d74d7
MD5 55199b0373edee0a93f53d42fccf5809
SHA1 20c35bf8d03dde6f8f0489c245bbeac222b0b4f9
SHA512 02bc13831fa43f817a5427a72c6254098e6ee919e4ed83cadacfee46c82534a0380abc70bab3be4465d7a682fae443cbd908005ccbfdf8674f4b8bfde2ab1ccd
SSDEEP 12288:iyPz5L8834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:/zyHSnnrFb4PM4MYgLxEVyGLv
TLSH
T15455025737A530FDC67A8274C4A21A45F336B8329B309A5F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 44cde46449474e070f3e5493fa3384b1a6b1be366d89103503a1fb1f2fae9794
MD5 e15c53d1cc2ff00f57b318f35119abc6
SHA1 3da368cd67fad0193bbf8347df8812b9b0921d52
SHA512 db02dcdd7d8feb463b46207e8772f43b04c179ac7a0b70a371b0a39f17e41bee61bcf0af7cfa78ec3461444f80d046963c2442d6a9e320faa32c436e037c8e9f
SSDEEP 24576:rTHaLl3z0zDhSnnrFb4PM4MYgLxEVyGLd:rT6LljVj4MYPVyGLd
TLSH
T1ED6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b06722f587a2d0b3ef12ba27fce900abab65088c3874fe57b4ceae1cd277a0a9
MD5 df2358ad8d3d7a8e59bcd48d3792dd40
SHA1 ab995a18ed1f4733a5d7875d5a1d17148c00ccd3
SHA512 61c7640d46606b14b9e59eac9623e32377e47f11c5d91f013fdd09d11a3d2389ff862dcc690430f1f5a24255572c3b68d25634b708b99c06f5594484ea0d89ea
SSDEEP 24576:J37d9CHKy7GZFSnnrFb4PM4MYgLxEVyGLQ:Z7d9CHKyaIj4MYPVyGLQ
TLSH
T1B975DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6c085f3a765477ad4c06778dbc582297215a4d953f6de5c9bb3d2c34b318a775
MD5 48e0728e6330c11c93a28f3eff9a9e25
SHA1 02b34a5debbf855d42232d801f9fa3e809cd6d20
SHA512 ae3732195b1d593b0cd0401ad8c0c2cf2d7c60b78b5d56d833dd5f14b42d11a6710d9ed0268db43e64dde4745ca3bea67324725e34eb60fde5b97e102c780e22
SSDEEP 12288:ki34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilA:kxSnnrFb4PM4MYgLxEVyGLy
TLSH
T17D4523A62EDC10EFCF5D16F0C1A966C8E2097C63F976B20F7B4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6576c385ed43d887d1be339ea30aa36064c5ee0ae22180b92bb299478fa291e8
MD5 58722ad56f6d5e2001049036e884e278
SHA1 40b845080e9161df4897e5cbbe163501c6b6267d
SHA512 f3ed3744c0e246da1983be2e95ad0895672286f65a46a7c7e894f1f328b63dbcdbdedbb4b1b155c38f8262df5ecbf40a328db7a1048978c567f803386ab3a6ee
SSDEEP 12288:6c34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilj:6nSnnrFb4PM4MYgLxEVyGLF
TLSH
T1724523A62EDC10EFCF6D15F0C1A956C8E2097C62F976B20F7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 20fe2e6ac19ec515ae6fe196f7e167b1bed47061049403a490683e6862da9fbc
MD5 d498ceb0b60d7289a7429e08e2f6b5a4
SHA1 764ea732c7cd557d1518e1a10cf01d67f3cb1c24
SHA512 64acb5f5545601623341789b469f780d96ed22491da36ec5c7eb49d704b38200f22068945a704898f0611609d832e47291d9a974a80e8d1f7b8f841b59a98a9d
SSDEEP 12288:yV34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:ySSnnrFb4PM4MYgLxEVyGLW
TLSH
T1834523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B8574073B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 25aa11572f174b78250509b8513dc579e4f9023b9ebd9fcc3605dcf43b208a76
MD5 c1856d8370b90d1b5b3de3be2c9279b3
SHA1 96e5edeec64ab5904999d806fa1527ea0dbf1d70
SHA512 2c183bfa2de6f0e7e782390a642e34533be23731f13d1d2c2eed73e87a5ecab04cec1ea5f2309a89da2a7f970c95ca3c6df8ddbf10b8326ca6bf436044b3a969
SSDEEP 12288:ET34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:EsSnnrFb4PM4MYgLxEVyGLv
TLSH
T1EC4523A63EDC10EECF5D06F0C1A566C8E2097C63F976B20F7B8574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 17bd22b4495800a7bd4f364916155a6929795ce13d5fcd32d3ac5aedef86dd5c
MD5 fa672b85592a1e372925bbdf9d5a2230
SHA1 5548eceefa0cb94e8b32d0f18461af36b5093b1e
SHA512 1292d36b1071e9dd7bd27912ca612da0b4483e491b5eaa4e4304471f06ef8302b33b79f6fdda71d73ec7ca05f8def880d6d13ffba3a58eabd921d5235a3b1761
SSDEEP 12288:Wi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:WxSnnrFb4PM4MYgLxEVyGLy
TLSH
T1A04523A62EDD10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5c344564a6075f6e898d4748063e5f284e80dd0232ddba60759cac4ead00dd3e
MD5 d5d1507726a83d4003a4a0b40214b98a
SHA1 8c73862f718ae65e4ff1db590757ff754a4f38f0
SHA512 c0b8a8244b9091bed2320a40a49e68259b108d0f1ec1e73db262807400338083981695dc83a6c924d88829df30799c3459976af778cec0f7e6753cb6cd603104
SSDEEP 12288:Gr34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:GkSnnrFb4PM4MYgLxEVyGL8
TLSH
T1774523A62EDC10EFCF5D16F0C1A966C8E6097C62F976B20F7B4574073B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4bc9d7e770051c8460e364e34838939404f77527a9976e7a7fa322e9feadea3c
MD5 12c4eb292af86b0b49047bbf8aa36321
SHA1 e786198aeee3d431414e7c0bd8b1143652285353
SHA512 64999509c7ba1ae67b2f966a93434ecbc7d203cd153bcb0f19ddd3b712e23b0a5f242de3e58c1649330801f651236f3c6449e4a3d64c4ceb206fdf7edc2e8644
SSDEEP 24576:ffwvok9RX6wkyAI4SnnrFb4PM4MYgLxEVyGL7:5MnYILj4MYPVyGL7
TLSH
T1AF85D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4bb5f27f248e11b812c57c99917864a2eada36e54256e6faf1499762d9cf8fa2
MD5 5f461eda09eea23216ef4e8e9c059194
SHA1 58cf4195ca682ad7b2cd130bfd8d767e5dd56958
SHA512 1489fe2e776cbdc79f50e870a99502bab007edb67fd6219a1863b53de1f665b8f6bde77edcdc5a5a3bd49c91d83845954a3881397019cd742931ede4166cae2f
SSDEEP 49152:qYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Wj4MYPVyGLi:EySzPfVG
TLSH
T1C1066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8d823979ee6053dec0b6db8ae0a2014b01765abb19d5786d7a9c757b6aefc36b
MD5 50554d1744eb492cf929e3a5295573b9
SHA1 e1cc13a527e9b1b609eda61e8d2da173058f211c
SHA512 2aea14bb4e5b40caee84a2c72f5075a610764fdd8b32cc5a2fcbf41ec0cd921fb4872b11edf9297e3df08c5839ee9c29d7755cf7877ae2490c31942263e9f25f
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYbSnnrFb4PM4MYgLxEVyGLW:V47JUQj1irIhCnDHUPfF/Gj4MYPVyGLW
TLSH
T17065BE1EA3EC01E5E1BA827885154A5AEA71742E5F31DACF2270837D6F23EC45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 620fb0fbb3174733c6ec86211b5c12f233e315a925663aa5d337789b6a6c27e6
MD5 d60f6baf8f26e491b0e3d9794f46c3e8
SHA1 db4eeadd091223adc7a19863ac82e293376a0844
SHA512 d26b54d77a566795b35ca31be2d106209b97389091b956e62146eda2b767522c49eab75db4a596aefe2fd3b109108df43f2a870601cbb1f13acd17d099686703
SSDEEP 12288:zNsfj34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilo:w8SnnrFb4PM4MYgLxEVyGLK
TLSH
T13355F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1000KB
SHA256 1fe7b29a77d1db75add4eb73837a87e90fb5ec22171328fd35c0b4e16f55ad6f
MD5 7c4f07d1cc948ebffb3da99f8db01991
SHA1 aab9b469629e62e08115c84348eb519074c9908c
SHA512 4bb793d972d8218ce8fe8453397fe3a0691440b66d29ac21ed559480b82afe4189275fca8ed5ce575e60c286af3edcf8f8601bb41d4db92c004c61896eac7501
SSDEEP 12288:/YD4uU3fMpuJ4EYm0+9bIqnmEbMgv7dm2xDG7NBDfMDylhSK2EW6VxH9JDe:gDPUP9JQmCXExU2MnDfkylhS/EW6z
TLSH
T16C253811B666D74FC6A940321E33C1CCAB707D01EE45AB0772C89B3FC576659BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 506KB
SHA256 f5f61ce9fcc2128ecb49dcaa718bf3f2dec9984b01b9cd70783e128a2a022f3f
MD5 9fe6d08397ecea93790e9cb31f4d553b
SHA1 38d846636a3c82a5c26e50ec84b1781d16e56851
SHA512 d21dfe37d44cda05d8a854c5b3512fdb4057972d6751bf2df4b6bb518a5b8ead46d4e97a49b966b2fa2e440a8ab9c83acac1b15533e1d0dda128c30f026c0d86
SSDEEP 6144:0bkGGNXFVEZVZXXIROSEJDZRBZkADZfZ:0lGFIzGOLdR7hdR
TLSH
T13CB4F841F636E38BC0FA5072062A9B8DA778AC03BB456F1733C84979D86671575BA3C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Roaming\Tencent\TxGameAssistant\GameDownload\dr.dll
Size 74KB
SHA256 5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
MD5 2814acbd607ba47bdbcdf6ac3076ee95
SHA1 50ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA512 34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
SSDEEP 768:2fqePMS8NxKDSYkK7U0H8zAqaMRmnJD+7OX4ubjJJYIn8n28zaTQ8PfcQWZcRZip:sPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVQ
TLSH
T15A737C472A1540F2E2C66231B6A5BB3196F5ED610F5A1683C3EF82DC2FB6787E211207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 815593abfd96611242ca7e1f9738d1623f88f8736f69c13a72d5d8f52fd9961a
MD5 d9ae2dc087b5ce90a2c38900e65c23fa
SHA1 72cd0376deafb8b2cf28732b7b1c0827b33eb020
SHA512 335cfc40153f2a13066bce48e42d14376b79292b46f05bbf0a19d8986b2081c8f0b133dfe0455fd3d72ce6e013ec0867571bbf138d1c9e3f9ef97fb41e72eb0c
SSDEEP 12288:vM7734XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilY:E0SnnrFb4PM4MYgLxEVyGLy
TLSH
T1524523622BDC14DADE7D16B081A99698B209BC31FF61F18BB74074463A3B6CC9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 09c64a43315b02b98efced9bbe3499c69ab476f411e28c880afb5763efd86828
MD5 9c550d8010ab89cc5448bbb04a6683f5
SHA1 82f875d927f5ce041ec0989607a1f6bee5675eae
SHA512 01f9b535a8db86c032375358251502c52222f98622e07a8e9c3512575cf64f13dc1a3c03c4ba335cc7b7185422868748e28490d9653c537f873b214f763aaf9c
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYaSnnrFb4PM4MYgLxEVyGLo:3gb4mBIBhGFkj4MYPVyGLo
TLSH
T1B565AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2a5869bde1f0c2607df7a751195826eb1aa4bef6eba48f52d3ab5f2e6e026292
MD5 1ae7c5704e0ea0657d8e2d3ae3a2136f
SHA1 55bc6b5af43c93dd7cfee72facc44c53a8acedf5
SHA512 791272a74ea68b4aaf7e65a7df125eacfdc187a333c00846d64a808c1c11b557329136b59baff4393b777a33dfbf9e613691bb797d21c2200783b2ab0985aa3e
SSDEEP 24576:4G88u8FpJqH1bzria7/mrSnnrFb4PM4MYgLxEVyGLB:77ZFPqVea7/tj4MYPVyGLB
TLSH
T13C85016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e0a4661bc6d0d0d0720b4397af19780fb0ae2e73a1d944e3a5af86717d9d36f4
MD5 13d14f6f73c4baa678f5118b546189a6
SHA1 6fc386bef30ed45629cac97ddaf426e57d1ecdd4
SHA512 1909e01456ac0dd8dc913c4849ffb953228d975758967f1cf7ed64a980ca3419b99656853efd01e20d064c9ea495534509e83ee22499b1a96d3a1eee347c6a06
SSDEEP 12288:wHvUrBFrEjwaQk34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:wPUr+NQvSnnrFb4PM4MYgLxEVyGLD
TLSH
T16265E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 df582f29280fba4fe74a682f65d3a626fa08248c2fe5e23685507e988679a461
MD5 309fe942117da638b59d7fc46cbc3026
SHA1 58cd55cfec8d06d708882c180c3d615cf6ba0185
SHA512 7d5a31383ed6bc2768261386a9b0e10183d9c3bcbcd1ac766500c19bd0b0a1a153a296241732d329cd72a1092cd4d667e8325d1e89f14501e48b85d6a2ffe877
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYj4MYPVyGLe:SG05lO43bwVi
TLSH
T11CD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 83c5b5f07e82e2f03ea6d89e117c776c96a575c10934a6be876809a25ce5c023
MD5 976fc21816e4aeca2c0e1db3ea2b6c33
SHA1 3cab67c4a0323f469bff7625071f748e544d1cde
SHA512 43c005bd8dc03077a2b9a0be09b308745a417ce7008174558ceb2adede5b29193f189ce681f0a7037a45e295bcdbc89e3c97447322da84f0c3642d2fa75a31f8
SSDEEP 24576:Jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9SnnrFb4PM4MYgLxEVyGL5:Za5POZ3+Jt2pasx2+mgj4MYPVyGL5
TLSH
T1BE65AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5fa5bd13faa16a5000cc5971bd0d85c59f47272bce0985fa6b9845ac66e8e790
MD5 d20926892a805db61a2e64b227e047a3
SHA1 0c044c2925d194095401855ecd9ec4cb5130097d
SHA512 a0f22d3cd205a7ee96666974a7100b7d21a2c3c59d3dccee0b7bb2c0c32af1df220fc053aa6215fb04cee28cb3a78bac5f5fa9da4dc0a04969f29c268813c179
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkTSnnrFb4PM4MYgLxEVyGLH:rNc/zEOVHFNj4MYPVyGLH
TLSH
T187858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 93bceeae9415c107fa3921c7a8e484a5ff4fdf7f2edd245488ac2404496c27fa
MD5 7783f0e4435bb4c37f2e1452d7eecf48
SHA1 8c117b563fb1f64655d909c288e3ae490f2f1707
SHA512 efb8f421c270416a7429413c658c5999007133cd21296055dc2b1a8f3621fae3163bfaa02185dbae92586b2d3dbcbe5889348554487884bb9ca7e366d35dbc72
SSDEEP 24576:38kNvNnaFeYhJNtmZBmZSnnrFb4PM4MYgLxEVyGLr:38MwBtOmSj4MYPVyGLr
TLSH
T1DD559E6EBAF806E4D1FEC6B4CD238512E6727461173292CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 0ea0127be13e62b3e06c584d36ad9b430e9db2c734034ca66effdb6a8d1b8148
MD5 cc44d9baa260fae5a1e0e8dcdcd0ac55
SHA1 9722be837bf55a282db68b51f761800e8f3a7871
SHA512 efcd8bfb8c1ac298066e77ec1d83edd279e1a7fd8f72f78bdbf3fba5ef916bbb8145813688a8d7b47fe2e485780c25c7b5003f5bc52ce2597ef794d88af5118d
SSDEEP 24576:uD3FHshBIYQgAASnnrFb4PM4MYgLxEVyGLd:uDVHeBIAATj4MYPVyGLd
TLSH
T15375E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2172-44-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2172-38-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2172-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2172-48-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/2172-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2496-338-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2496-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2496-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2496-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3632-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3632-327-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3632-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3632-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4556-291-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4556-71-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4556-65-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/4556-63-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4720-326-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4720-111-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4720-118-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4720-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4748-131-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4748-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4748-133-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4748-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4748-125-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5756-120-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5756-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5756-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5756-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5928-84-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5928-90-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5928-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5928-350-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5928-106-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5928-317-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6496-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6496-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6496-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6496-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6600-75-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/6600-80-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/6600-93-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6636-5-0x0000000000400000-0x0000000000CD1000-memory.dmp

Download

memory/6636-92-0x0000000000400000-0x0000000000CD1000-memory.dmp

Download

memory/6636-6-0x0000000002C90000-0x0000000002CF7000-memory.dmp

Download

memory/6636-0-0x0000000002C90000-0x0000000002CF7000-memory.dmp

Download

memory/6964-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6964-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6964-52-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6964-270-0x0000000140000000-0x000000014020E000-memory.dmp

Download