d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
Size 1.3MB
Sample260807-khwtcs1ble
SHA256 d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8
MD5 dab5e882d47d7e5780d2098cfe45686f
SHA1 d728dbf24840391939db0593ff5eca64e95f0ffd
SHA512 907668207f0a54c9021460db6c33e8455395756f7db85f8ffb624257a5fc20941bbb7a4630eaeb3c3280698d2b207f8624c70179f9fa6309c7619e89592e763c
SSDEEP 24576:Nylck5oBSwDX3f3oEmh7nHZP6D5ou40u8Jy+5nQ/tbw/2Mkjy6Fr7g0o4:Ilh5ESwDXP3o7HlZ0jJR5Q/lFTjN4
TLSH
T11155F01177F80969F8F35E705C348B29AA3FBD359D35EB2D1684218D2D38A519E22B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5824	elevation_service.exe
4324	elevation_service.exe
2576	maintenanceservice.exe
2508	OSE.EXE
2688	PerceptionSimulationService.exe
4612	perfhost.exe
3832	ReFsDedupSvc.exe
4524	SensorDataService.exe
2900	ssh-agent.exe
4100	AgentService.exe
1108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5fd37d20e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\msiexec.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\WriteConfirm.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000013780c2d4826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b50b92ed4726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001658932d4826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcade5ed4726dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000603e5e2d4826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5824	elevation_service.exe
5824	elevation_service.exe
5824	elevation_service.exe
5824	elevation_service.exe
5824	elevation_service.exe
5824	elevation_service.exe
5824	elevation_service.exe
4324	elevation_service.exe
4324	elevation_service.exe
4324	elevation_service.exe
4324	elevation_service.exe
4324	elevation_service.exe
4324	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	684	d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
Token: SeTakeOwnershipPrivilege	5824	elevation_service.exe
Token: SeBackupPrivilege	3832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3832	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4100	AgentService.exe
Token: 33	1108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1108	SearchIndexer.exe
Token: SeDebugPrivilege	5824	elevation_service.exe
Token: SeDebugPrivilege	4324	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2632	1108	SearchIndexer.exe	101
PID 1108 wrote to memory of 4232	1108	SearchIndexer.exe	102
PID 1108 wrote to memory of 248	1108	SearchIndexer.exe	103
PID 1108 wrote to memory of 4424	1108	SearchIndexer.exe	104
PID 1108 wrote to memory of 2492	1108	SearchIndexer.exe	106
PID 1108 wrote to memory of 3836	1108	SearchIndexer.exe	107
PID 1108 wrote to memory of 5752	1108	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe
"C:\Users\Admin\AppData\Local\Temp\d394e34fe832bc0735a1583eeb119f164352fea35ab9416e4d599935cf3c27e8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4324

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2508

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2688

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2632
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:248
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2836 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 03385c317a9292639de770cf7a78bfcee9aef45b74ccf8aee5ab89da126348fa
MD5 4f55b7cf05827205531506cba64fcf07
SHA1 e58add534330317be778f03d1d1f0d440d89aff1
SHA512 d20b21c2bb6c2aad3b06e304b126a5f9f495a3ae67b5e4dd7328ce1d9b6c76a31a340f66866e90594d6ef53de4755fb3d846ab93c7b59af6390c76f6527490b8
SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnLQ/lFTjN4:Y3q6HjBXLm
TLSH
T169D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8ea1379994f13de37d5e966ddbbaf58403441c77b41776de7ee617d5526c5761
MD5 58b00b0c809668cd7d3a8b6d8a33ebcb
SHA1 603806f3180b66ffb8a4bc1db2067df66bc24b8a
SHA512 4ebfff414bd7345f9a3e1d1e023ae09708f3d8cc284b5840bac51fd9f861dc271a4dfd056841c02db3cb1195d7efa76a68056d709e0a61362d21fcdcff6dc690
SSDEEP 12288:C1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:IXYfDtczAQnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T12A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d02ef1e8e0a92c7a27422571fb5ad333068ae65f58ccd7134269bddb53b97d2a
MD5 1b76dd4eb3c6a4f29f6d6027a4c695bd
SHA1 d2c54212e4375676a7cd69936d2f052c4d8462ce
SHA512 54b379cfed01d34ca0c0a0226727c068ab171e01fc91e37ff583f5f9a25fcd279b36b36e48da78185b4a55090648e80db1172cbb343809036c62324b7cac200f
SSDEEP 24576:e0Le5ji0hmxLrMTnQ/tbw/2Mkjy6Fr7g0oK:ePji0AleQ/lFTjN4
TLSH
T15B859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 10dfac3cc65782a48b84ada0fcb1724fa04c59cedca2f6165677bb67031b4fba
MD5 427a685ac46518a93266336221b18840
SHA1 117ea7c402e9fc49c2d8507a26ddcbdc71165f80
SHA512 00ed2bb0f47cb029b2cb1f26210cdc658c295b46c0bb825b4895e9644f1073c8f4d5a73fb7932ac6cc52b03b4605252777cbe12ca214dcf9bbb8deaafd7d0aa7
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyudnQ/tbw/2Mkjy6Fr7g0oK:a/ezSC6vUzPvxHjyyQ/lFTjN4
TLSH
T1CC755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 548f98505509c281f1c75b1b4872ebcaa114470b6cf92d1315827a84f22c87b2
MD5 8231f1c11917294771af705b698cc372
SHA1 1a2f0303ed69150a416b65853a481c57073b11ad
SHA512 3ac2488f8bc5e43025216ef5c292c7f18550b58d376f7c99a0a3bdcbac1c3986fe0ddc6fd4367a275165029492d19b5a43b36d89d929c477bf122f452f01b22b
SSDEEP 24576:zcVbqPb88hv/l+6cnQ/tbw/2Mkjy6Fr7g0oP:AVO88hXl+HQ/lFTjN4
TLSH
T12F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 eda9be564b8ac2c419aca9aa63dd2559136b417ee405dfa734c554cb6af68d83
MD5 ea128e7659e0564447b94f2867f7b0be
SHA1 f8ac0c76aa09d6c41f2b62d4b84bd671df6d0a65
SHA512 bf74e72d05aa92d2b7b5a32e7963a56b4ca73caeb2833840a8da53ed9fc52826dfd6b33af276546064e022553b444b98a3dd2c5bfa7f113b113e74dafd1d61f8
SSDEEP 12288:hz/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:hzfnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1C75523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 4d4aca88e4e46836a5ad14fc3a9f2bc392499f4059c0ae04464c2aa3c5c48499
MD5 63a164335342ae701582c0a70dfcf2a0
SHA1 3589bd2b819551901bd5b813d2c1ea9cad9ce1e5
SHA512 efab0284ad340e055db1c7c050ed096d5fbe055742466f424f5937199ad25d3a0c5b91ba848d8d9c190212900332df01e2bd195c7fd71c22d3d2029c7e7639a1
SSDEEP 12288:JeBNUbTVO86UkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWve:JJIUEnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1FA75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5e2c70e465116bb42fa2b44cd934802f9d2bf4849b40038615baa284f7488154
MD5 fb2e484c4bf9f8289a744fefd74b5ff2
SHA1 d700a89903de231cea86553eb9f6dc7e93668539
SHA512 79db5a4a36c6dd5ac9bd8a72af538fd0047f2ccfc1c9e6ad7e6470ef52178213040e48731570e4d35557ec6b21e77fc51b3d4692cfb793789d87fcdfdd199cf2
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:8QvGAdlCEL8c/yRNw5CiLm
TLSH
T10B267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 fbfb89f3e1186aef129a824dce608e15fbc691f59a682c05f662f3dba73a695c
MD5 7c180f0726a741965a55825ead7952ce
SHA1 a840a1d0ed49847cf19272b77a668142c6b7637d
SHA512 9a5d6fc70e9cb543a1347ea25fb3a7e109664bc39b227fbdbd2555b2547f95feb7937d19f5c10f37babf10d8dab3a2c40940ce3a21d47c49e47f3e8859740ddd
SSDEEP 12288:xAwSfxL/2Dc39DLLmt0LDQewsAjuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgu:SQewsAjunQ/tbw/2Mkjy6Fr7g0ok
TLSH
T18075E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e2886593f4393c5b57ce0c222bb40e4342582eb2635af39f1373e8dca4bcbdf4
MD5 3d1f385c7bcc95c2fa041bb653f20dd4
SHA1 a020bf352f6970675c752f25c236474df4e9f311
SHA512 a0e47107b1b78558e727dc1c6b21a45c9527e2e5e44ef44919176c8de78a31df96264ee217035dd66f87595a346016c4688d4a2fd476fa270110e1ed48a454c0
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHxL:JUEtQevvqc2W1cpV2EI32
TLSH
T1E2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 de89941d80a7b3c88bc007bcdbeb6e68e223df5d6822507b969b1ba48de68b86
MD5 e575294d0a03df3c9887f4bc8294cc13
SHA1 4f5df9c0530d839e87a4b38a1c8bcf7e7d53f772
SHA512 f1a942b53baa58b366de0b103e51a7843f175b43e1f166f24c567e87ed8fd91aec5b3decdd3d0a688a4d7259787723955cf05f14d36ef01c8d4706ae889ce31a
SSDEEP 49152:dCbRquA/m2yL5zQfFiV+XenmE3/zOQ/lFTjN4:aoqtVjnmWLm
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 142675378ce83b6a4a5cc8bba38f2fe74ebf2ec2fafaca5230ac843b99fd1e05
MD5 731f5e3761035b76421fcfd0f446c980
SHA1 ee25dec1f638855ad059ea7f7f54c4a483d782d3
SHA512 a3f0631bdb40fa7c85ce1ef0df93f238b16793dd19613986f3b6aa345b2e71039cbcc204b17310f2aa6c33501d795907ee294518157dea33e427cc07090ed8de
SSDEEP 24576:mAhGLJIFoiwtA5l7S53RnQ/tbw/2Mkjy6Fr7g0ok:mAMyFoiq5BQ/lFTjN4
TLSH
T12535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7ff707c0a1ebc8c61c5e745cbf98d37316d0180728b6ed98b42b764e44ce5f1f
MD5 7d645320a2f02011f909097cadc914ba
SHA1 eadb8b377491e3f19a1a95b0bae067f418894542
SHA512 b65f2ac977deaf91636130789ac9647a97cdff9c9eda80705db04a44019d8a18d69175625f7e3aff6ad46a04cbe5733de462aeec02defcbee38d1d1229b2e422
SSDEEP 12288:Lmw5HEjsChN2BFgl0WDm+C1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMb:KwuHOWynQ/tbw/2Mkjy6Fr7g0om
TLSH
T1C765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d0ec38401433efd2c62dc0924f6b7b28d75f7e981376def65654fd409768a3f9
MD5 fe63d9dc0ecdf429acc7da5c40afb1ff
SHA1 4b4767876964e66914a445365f5def03de9ac515
SHA512 56347e6e6aa92473a914a26362d8fad44f7289be450d602f8bedbb9b785d5025ee4a8abb11439745a49c35ed965eb7100c2958927e8b1c5b9622966e3903152c
SSDEEP 12288:dXZ1Iy+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:NZubnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1BE55126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b1f4089d8f5a02274288f6f33dd1cc111252b4a2c31cf4779399bdd1f28325ee
MD5 fa7812b5ab8e941832403cefc2030e4b
SHA1 059c4f431b76154c11045f60734b9b6e122f69ce
SHA512 da1bf7f07453d45f099df1142c5683c7f5d0784723f2ccaedddb64590cf0374f49595691228b87edd99cb6d94cee437ff537a98b2149d54fa2c6edb243b4bf7a
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:TQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T19A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bf7ec76cac1220a0f4794ffdb3763227f6014ffc094db52861f53d9fe2bd4767
MD5 6e1fa41b37404f5dbfaa52988680e095
SHA1 9e81002335b6ce37cedd911b078e796ae9cb7b83
SHA512 f0cfa03717437029ecb4d63ef5615ba5e791c6e8e5ec9d42b5998100d6dcb1a2737ed3c2c43ac2cac98a285354e6967db504f8c4cf63d346b38919d657fc5b5b
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Um:XQRQyi36YOcPQLvw2gAf+PN3rLm
TLSH
T130667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c3a4bf547f17de83c2bc785b3c480d8b2cafc532c84118aea510d71d745689ac
MD5 931fd645e4154ad2a39817a4e0e363e2
SHA1 f24f7cdc6199379b491d26814b9850a6affe21b6
SHA512 bf39e4df9c890e599ea9d1579ba5a3ead517de4391c16065d020b0899c70fd842cd16b98b57aab6b6e902625b257c9ee914691f29da87f44f7157ec312f65293
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0LnQ/tbw/2Mkjy6n:168Qg55nhheWu7PNU3/eQ/lFTjN4
TLSH
T1BEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a9ad803b047d2fd4816fb43c9d23da6b8996044f63cf45277cc77ead1c8d70d8
MD5 31ecf79bdfb30e043cdf3206799c965a
SHA1 24e0c9577b8525b3ff014df0447c169828e8ef07
SHA512 65fb92f8183ec4e59c0e4d5fb96b877122e97c6e4e4c034a3af576e83ae1f0dd09560669cdcd9bc3efdba653ef050ed436a3647f0da08c4da20bfac733b96891
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:5y5112gYy5azzVvL69nLKnhZULm
TLSH
T159167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3dae7e620baebcfa788896392addd51860e761016bd0fec47038bb99280df806
MD5 8e6ec1af44f73d38b2be6f544f4ae30b
SHA1 82ffacec431a1f69c03298203319604ba8d0018a
SHA512 49c55d5f2473c37b46ec7d1f2815c99d1544c52c20cc1e2ac191e1fc80e19beca43ca73f156bec1f17246c5024a23dbbdc024ff1629bbef11ed66962ccdb5cb7
SSDEEP 49152:9B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgQ/lFTjN4:ju6JmVxd2dzLm
TLSH
T1B6D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4c1595f3681d1e5e6d81328d3c1868b007d5d93e1bb04ea2fecc0d034230b3ee
MD5 8030defee4a7e26a13dbd14b206cf0f9
SHA1 b5cd68bf16d8646379247a911f5774f0db072f18
SHA512 badb3f48e1e6943c1adf89188f591ca7bf02dda9ab2f642ae27e4b9a8a38daeca95b44598e134346002a4704529dc6b8d590b7008ddbc56a1a9712ffeaf404c9
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xkQ/lFTjN4:4mifPbRWLm
TLSH
T195B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 36118050d5879913239ab0138766c652d288a4201d566b1278e5e9e6f3e27848
MD5 74f7a69e5c9f4a675fd29a8858555fe2
SHA1 eb1eaeb113e3bb965128bbee1703bb52bf167102
SHA512 978606fdccdd0831302ee3caa0b804865e4feed334ac8ba660b75867a8df58bd72d731877ba72a0837484e91e311fd7e44c563b00eca5abe046ae426c823d3c4
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqbQ/lFTjN4:A5dKTi61QLm
TLSH
T1EFC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b1ea1efbd905d75d7f098c28909f8891d6e1bf4460d35c5aac6842f7e99b366b
MD5 9f439416199aa0ac0b6cb9ba821d73c3
SHA1 872b2cef2e83734d7e633d69e6ba32e4423871eb
SHA512 e0afdc4d624c5c7b2109924ee854824ba8af3b7559460979d4860160b230bd1ad27b600d7d75621264b36c38a9c4e691fe2982b4ac5f5946069785f0511c2d3d
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wAQ/lFTjN4:iX2iyphqLm
TLSH
T16B95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8c9acd1a5c4b5be5f8018f9b7be41b483f641074db1a5f246532d025a5d8e551
MD5 4b50a28e59b4aa32aa4684dd3c6f6fc7
SHA1 d09661b8ad23112f5a394a02d9c01aa643b5c653
SHA512 c9d9d680747196a83d0670e7f9068e0dffff01528d443286d9efa4a1040b0a800e173f7c70f099becb5518933c01e9fe61315f33b7fa925a1f15f0ef53837a5a
SSDEEP 12288:rnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:rHnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1B45523697964F98BFA1706F18C828182A77F0EC6BFD1938F77482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 4ada2e8cf85fafed82b9084130e74510de2b4f08a509726296dc439a6b1b554a
MD5 565b6dcabe9013e131d2aac80616b1bf
SHA1 9918531e77888a3e726f58d0f1285bc29578e77d
SHA512 f298c22564eb974eaeddaa2dfd368ea26f8ab760de99c5e5e6c8b6ada8e9a84b25ecaa1cb5ec47692ff1a778e0ba3da28d0c8e0b1eca1f1db1425cc05144cd98
SSDEEP 12288:FqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:FqnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T19E5523797965F98BFA1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0f178cc35d9efc1fc34babe702dfe673588fbe5b3633736c2da9b471cae72e1b
MD5 15b48b46d7b9ed130ca486742da001d2
SHA1 27a347c66af53ae03bf07d75806f2fb1d963956d
SHA512 1f968be767d875a9ce53af8da045689ffee9e4ac631a865fd11f290b4e903aeb6ed67f76f4855763d40a7fba36d02b251bb61188126997df69e032cd921889fd
SSDEEP 12288:gMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:gMnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1115523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 83bf7ca34cb712c6dbc88abfb57f6a9c9de48321bbb0c2508622eea056dda8e1
MD5 be89e584d3d5140ae5a3c30b720c30af
SHA1 3ef52f7a9bb84fb9833bc5ad52fa3ab7ba115ced
SHA512 eab68be49be9615cecb19160631aeb7d613a75bfb014cdee562c6c9fea91cf6cbb93f21f95c9d6a51e9fbaf02f432416a0342ac31efb81db8c8ebc8403c3040b
SSDEEP 12288:6VhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:qnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T10C5523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b16a962af08e3ca071083a84e5b4fec7a144314aae289d3c3ffa6cc910e0f2a7
MD5 87483728d2fa7ae4f7d9027826dc9418
SHA1 02318a7a917412c1867d732159f3636159553c4f
SHA512 14099adef848138f4d726abd8e350ff102b403698fa80036acdda0f9b001234ef9cc7ad94fffe305d215aa4135ace230be716b76b3f39dd1c04ad724a55f91bd
SSDEEP 12288:EZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:EpnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1E05523697965F98BFA1706F14C838182A77B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f37f4a32d536b44e97b926296598a6d115fc60f772c3dd4b7ded2de66454f791
MD5 4c63ad96afbe1ebb8eb15cdf504967c8
SHA1 cb4bae6a96f49fc8a29d3a3d92aadca0833185e5
SHA512 69b87bf498a3a40760fc1d480e6ae980a41f87ce6d64c29b15962923bbee1507e77647cd05e465e3c90516aef9b70d48d567b5e7dbc313d89ea95f613649d064
SSDEEP 12288:zWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:z2nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1C75523797965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 da9303c85aede190a193824ad1bef1f12b473c586d4c2674fbf93ee9b9c57f07
MD5 d179028a5bdcc72dab88b4c922d67968
SHA1 7c7ea8897e7cff868e290c4eab2f05fe587436e4
SHA512 6bcf7ea57266c43849fbb3a4981c61e9034a27b469c8d72b24f1c0f0cb5f482c58dfc6f8656e45a284530d47c2cd739723235e28d4f223379fc3e927ae5c3927
SSDEEP 12288:oCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:oCnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T15D5523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7be8a7018f108a4da82eab118f056f609c06c4268666c26037e605fb9c77f982
MD5 e3aef9b729541cbf016b20779a109d78
SHA1 bbf61fef63966ae314c23fa47bc783aa35733cb4
SHA512 3e7aa82f48bf405bbfc2af7eeeff0add8fab6ee1df5b823de5ca97923dde7123e83ed49e8c6f40d02277738068f30b6cf6fdd4cbce02c0f95bf5c66f3c723439
SSDEEP 12288:+iZwbDzzFEoS2cPvyKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:hZM3zFVSOKnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T19D7501A5B35058F9EC67427ECC518906D7B27C5A1BA0C70F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2aa8219b70d9da40c3b3a992aa6033897147fb2710a7196ac70f1b2c2f372c19
MD5 b58adfa33ddf7564bdf4f0c4c192bf1f
SHA1 c206e211f36ff00ff4a8005efea1063f22b87511
SHA512 f8f55b98c740800d2371d9231288c7db0c42233a5ab97c60c97af77b8021951b7091d92f21d2def31da8b015495d032cd780b859a2b307124b6bc61bdff6ae65
SSDEEP 12288:s7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:srnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1715523697964F88BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e537c0d1eed91c7a511d73c658314e8023d2bd84bc37405cfe0550bdebe49795
MD5 a842df56c4187e2aca9f1db49a7e78b2
SHA1 7a8f583723c75f923b879e2d44fa511e1ac038b4
SHA512 4c94173f7138310c203c4f444f9721ed4d1df96d53d39d9fbbe79a0e6f8569d5d291aaeef9a030e187c78053f6e03a3150a15d2897925b278736e9ff886b44cb
SSDEEP 12288:IPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:IvnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1FC5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9c62b197f9a5a0cedfbb012b047fe78d81acf0507b5bdc606fe7ec11021dfd4b
MD5 c64c817f0fef41df65946c14e612370e
SHA1 01324d5dba73ec2be894b61ab3baee1b000bcd2d
SHA512 8cf9c5ecd9e4aa5e8c8cb0b5cf2b51c82459ab5f8d497256462e4bafa077e5744cb3353308a3f062d39b5a78f7b24c3bb514f51c2731faea540a6692c90d0767
SSDEEP 12288:GyPz5L8+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:7zy+nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T12465021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 44393f8dbf22f81c7539c7ee33b27bcd1040c5e674c72842780743340f28cbf9
MD5 1231e4f5b3b79f9d0e3c6289fdba7d0d
SHA1 abefa5de5f88a5b5069ffd1ad845fc9299f2ca4f
SHA512 d547608e49f94b3fc937b26c5c18fa3b7ca42aa13d5ac922c89e873a251342166489344bdbd835e8d646cd881602576ad9d148e92350fb8748db073e8053f0e8
SSDEEP 12288:67GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:6rnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1085523697964F88BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 2b3fb6c305b64dc92b423c953bee7416d504bc1796580df89d45474f078c8eb1
MD5 8b941947a15b1c6bb6156a97aa398e2e
SHA1 b0260b74fe5985bdf2532f145c83c2489e662981
SHA512 1e97de8b9f77383147fccdbfe1c6f7ba8a0c36aaa2a71924c64d613f7582b085fa22e46538d8d148b4df1388cc6bbe189cb95ef5317ecd854d47e85f377bea39
SSDEEP 12288:U7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:UrnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1075523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9b5177f761edcdae24943ec5fd64c4954b724c84fad9762e15832a51e6d56e9c
MD5 fa94b2bcba1ba09940583cd2144e0641
SHA1 c9e225591d8a6701c62f250a7b4510c62488d6eb
SHA512 e102ff5e3dbd3c9215d3a01e389900b507d6faa8aa8ae34d400ae2b87e046442edb54591b811594cbc39c0ee8bf3ab2614a7264f3e99ebbe1cf4fa01fa6d391f
SSDEEP 12288:SyPz5L8+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:Pzy+nQ/tbw/2Mkjy6Fr7g0op
TLSH
T11265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 599afede9e1df28cd527adc5cdec38fea48dfca4d0ea430e5441076eb6111a9c
MD5 d27015168b8b20b6632f82e636deb726
SHA1 a5a33cefa4d2efb7f8c256c3d8c3aee7ca712353
SHA512 07e3e42921140b39f2d1773b4abfb15b834ae198e7c9fecba0dcc6f06f537802d6bb93d24cb2506e4e51029b1fe8ec6fe8af739edeba8f871e7ba281add7276e
SSDEEP 24576:qT0aLl3z0zD8nQ/tbw/2Mkjy6Fr7g0oN:qTDLljdQ/lFTjN4
TLSH
T1627501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 73fa3705fbd5ecbc8796cda2f1370137ac6cf25ee9a4b6af7cfc41d6964996ea
MD5 2b56831b4d86faae80ea38ce5c93a37a
SHA1 2fcd27331127337d43a034cd5f4c7d29563316d2
SHA512 00d4e0ee53d96c94e4703520b604a6b5084a84f228a6c65d87986f275289fa74c2dcaa1c62a9796bfea5819d19a7d6a8893b04fede6dcd8d94840410e73953bb
SSDEEP 24576:031d9CHKy7GZonQ/tbw/2Mkjy6Fr7g0oO:+1d9CHKyaGQ/lFTjN4
TLSH
T1E085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4a781bce701a2913fc0f9bfe30d364a4e8f34ef556b5c90325d39c9181550a0d
MD5 7fbb75501cd64136ddf0b64982f62ff2
SHA1 9b773134dfe027a5879ef7e3e92978ba68618a3a
SHA512 2540b622debf0cdc836da987e154376ae8cdd9f437dd880acefd9b279fc49d9e1c46bc3697a509d2161687cc8b10a2c8419d1e1c7989f9010f6f5bcc0dc7b359
SSDEEP 12288:tsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:tsnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1295523697965F98BFA1706F14C838182973B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4fa96171eb93322b5353609cfb03d1b694e49bd2acd5990ddfc9a4aa490a9b6e
MD5 a7c57816a6b24a3206a713403a386c98
SHA1 1d5ddb01bb86cc4bae7b3705513674721c552c25
SHA512 3e8cf17d209bb8477e947f3b28f4ad43bad0866c85efe73dde72d9a15261eb8b75077d25b763e680dacc09c9e8a1313859c5272748b7b804d33163b6da8af286
SSDEEP 12288:AeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:AenQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F05523797964F99BFA1B06F14C838182A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e6b7ff7315fab577a9f7b1c9deaed20c8851d364a2d1d400e89c7d300f9d13f6
MD5 16caafebd955829dc90417c9d7b31acc
SHA1 bee5e5234354136382f3eece8360f00f7a80f080
SHA512 3ab7e1e220a8d720958d7605b5bc8fa03af23ad9d9576a5a08c4fb4c354c421fac0c7156d15af2a2106c3dd3848f0984d260dd32ed3e23ea842ad82f6df7f986
SSDEEP 12288:I1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:IVnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1D85523797964F88BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f7842515fb2ce4955c57f569b87c57d1ce5ab6dd664a40d6723f7c62cc5aa4ac
MD5 a5a736df612606e120f028c5cd045577
SHA1 79730380a36cea956d25ecf21808f15acb6a1291
SHA512 16b8bad03f0467bbad65afe3a679a833ee57d7195e02cc76dfaacd6a48e7ee0a71f2b27dbe47572f1017b392c909b65cc46bb047e942362806ac857580a95842
SSDEEP 12288:P7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:PrnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T12E5523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 b15e0a76c018f975aa99bcd8ee17f05e3e7c83a40e7659b488f58c2a86668fa8
MD5 ac0e9d9488ea04af4f6d635f976855fb
SHA1 bd4ca8918a3ded32facbc52f42c0714065a35f26
SHA512 ae91632a6be697d73984c8e6b9df3e4a4ba1c49a4dec3f8b61d3425f9f7bdf052f315ef68e367e1d045e4c4d8ed8315f486a9f9a8ace7a442ee772fbd8fc82c3
SSDEEP 12288:esGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:esnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1A25523797925F98BFA1706F14C828182A77B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f2c8768ead8088ff154c62706412cbe7d4b03711af11d032e61fb27d876d4ce0
MD5 9fcce4875b7a0cf895e411abd9551a0f
SHA1 328a67967108f8fa6ce2c8606d16e60353e83cb6
SHA512 9a23e3312313ccbdccd1b6a07946af89e610cedc0052113378132f8e558ff59ea0d1a84ceea8d95050c351a79987bd583456f11db3dd468beab2c7b3b6b5ddfd
SSDEEP 12288:gTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:gDnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1E15523797964F98BFA1706F14C8281829B7F0EC6BFD1938F7B481229967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dc66f56030e2b6b3cebec853e5bc2ba0f2c4bef09652e1940c294d78af550df9
MD5 4f619b431a63202da92a8f3bc407934d
SHA1 c121dad22a23e94288034ca0c7d9f0261ea8e889
SHA512 99aa2e96f5c58d9faaaf0797ab333d8dc567d9b8cc538501749bac73a09ace493ae1194a2d9e8d38d353c2f7053c0fbcec3a1d76a71e2233f9d91edaa4c2d19c
SSDEEP 12288:2ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:2pnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1C65523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 345c3d28cd5af327744c082b114190fe2de0b0024819e8780a7a0ee6955b5676
MD5 574f658509b2dc8f892cbef5e733a62a
SHA1 645c351c48071d3556706c44eb8259b323fa4096
SHA512 9a06d9bf0686483dd6743a1f0dc66f1f7cdb9aa01c1a3254b66fd0dd78f6841a9c41524336490346b0dbd05943e8cf78384662657ce2deefae75218cf9c65fa3
SSDEEP 24576:Ufwv/k9RX6wkyAI/nQ/tbw/2Mkjy6Fr7g0oh:jMnYI/Q/lFTjN4
TLSH
T15485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 136244fa31830ba1970a18c576e532de9cdf9c0f8478bfcf38d72221461b6f5b
MD5 9234f62976869a406643d515d5e97559
SHA1 7b75c25071b94fa59b59d5be23eb3d2c34ad7c89
SHA512 b9784fabf0ba540295332b93e11f1ca836275180aa339eaf818b67f1d87cafa6b706c4c7f147fadd5eabc00c6d3ea732fa597e6e6db0f4fdf40497182a4f4b37
SSDEEP 49152:CYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gQ/lFTjN4:8ySzPLLm
TLSH
T1A2066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d417d1cec24cad91915d68fc36a2732f29419b4adb1ff2f48f91f84a41c501a9
MD5 f2a5faef1708f0c4c24fa81a0c84d3b0
SHA1 0313f8f1d11cd81e50355e98f7ade6715ac42772
SHA512 faa96c643d908097590fe6f66aeeb3a0de3185557b0f3d8f90ad03d7aa65043b368e49956ef4f071a7440e742a6c89678167ec6745c4c26242b34fe80f01ceae
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYanQ/tbw/2Mkjy6Fr7g0oL:z47JUQj1irIhCnDHUPfF/wQ/lFTjN4
TLSH
T1A665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 404e47d0d1696395d48f9848f5cec6b2465fcfa01ebd2d8f3a2ed5ac6f8f0559
MD5 d26bc0ed29f9aab75c83b837927492de
SHA1 e1def125a430303a6bb7e85391c68578653a67e0
SHA512 e3a8e5ca397d022c1127486a783773a2062668a69f38bf1c7d5efea384e812357947bf33e1f2832baead388fe3b22784c0aa36c2eb5faab62c6b7fee52c94e83
SSDEEP 12288:7ssfrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:3bnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1D665F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 f6752a9789778ddd8f49c597daad1ef517aaf9601a5d2a243c2cbdebc931316f
MD5 df92959e51713160c128efac36783068
SHA1 3d4eeb75c3ae328038fcc9e3a8c0379a7f245e0e
SHA512 7f3db7003aa820ca451fce7d9aaae4af229d24364801c548a40839f9db31db04e25d906279d426b49a43dca348c6677780c2685b5283b12c5ec35e6bef20c09c
SSDEEP 12288:Bw9dAU3fBqTUKMTXCgk948ONMrwcCN3CwifCwv75:Bw9GUPQTWI484MrLA3CvCwV
TLSH
T138452700762BD78BC5A950325E36D2CCA7707D41FE05AF07B3C9873F9476668B6B6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 200c3959361c0e99ec48e513da9ed783120210f382c83ad9f6554622d76a6772
MD5 6165cabac0ce313080c6261a1bc7fa05
SHA1 4971dac38969fa86daa83e98871ac1b263efa506
SHA512 8af2260d8b811589525bce063fea0fbaf675babed04b6a1a4f5bf5ee107ea488b78390cd061125a3103aac564bf9d41f28214f3209cc9b3420779e7f4881cac5
SSDEEP 12288:NZcLzrKoYEc5Mu8CWpF5NuwkbUpOv7Yi3w5QH+CHcONM8m0DbVji:NZcLHF7yFLwVcvNA5QH+CHz68/DbVji
TLSH
T169652A41A5ABE35FC9FE5037423286CDAB745C02BB453B0173448A3C98A75BEB5E72D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f0a7d9c4a623ed6973ff94871327e41d67f0c4edbe93fd985378a2defac29d22
MD5 6036b8796e8a807d3025a9a0ae668858
SHA1 31a2292fabd88a9e9ef78273373f2132cf59bfe0
SHA512 a35f300d12c630638d6463ddc8bda17cd137e066d5b58f3d50a86728058707a391c696a71cd4fe288c7e978236e1602b1c0d1b86d858a904bb68826666dee141
SSDEEP 12288:P67jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:GTnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1495523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 923ddc79229829136f4c864ddcfd25db2b0b5a2b880f2c094f8408dc386efd3d
MD5 f110966d51eecfaf203e717bc92439d5
SHA1 e48af6f7a48fea11af23b94cc7bc2881e6d2ec4f
SHA512 104e3c5b0f9b5762d66086734aa9984df7fad3e8a7d975ec1117753cbbe5d07094480593a1e2924456e37cdc116508c9a47ea64065c9f262f8ce76f0749b2bbf
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYdnQ/tbw/2Mkjy6Fr7g0od:Ogb4mBIBhGFaQ/lFTjN4
TLSH
T1DF65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 31aa9171acf42ab59d701af8e1872c6a92f77754ba738bcef6316e53f1c9e5af
MD5 8664383a4664c3d12f718039119a5993
SHA1 f61cb4c595bcf266df2b0703a188df8cad7aad1c
SHA512 a7b2968b1e158f2783e86a5c1992c04c6c39f211a73ced655adecb5d239c4b179e462a0449cd84a9e3a032b9c70940180fdc84d52a9e2f6cd2a53a16960abc11
SSDEEP 24576:8G88u8FpJqH1Qzria7/mKnQ/tbw/2Mkjy6Fr7g0oQ:/7ZFPqVva7/1Q/lFTjN4
TLSH
T11985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f46dd3d4a68e98042c9c2b5c13aeb087bec292d0f11eb8e7493bcdf40c94caf9
MD5 3f35e3c4076122a829bb404177e06fb1
SHA1 776a86d5f33cff635f26b47b88a808e45d83394d
SHA512 c9ae7940e05cf87cedd28c8e501a302911091d2e97d6ab0341108ce4d02c3e63a4d2e37ac3364c0e5f63ba722260a8299df83b04e156bd4ea9c37383a342c371
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuQ/lFTjN4:1G05lO43bkLm
TLSH
T1A2D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3c2d912f243f0b85a9c239a2239e2fd365c1281940059d52cef184e37a4e8472
MD5 891ab1d6acb5547c1d81d9963baf9932
SHA1 fb9234df48e8a119dd3c8efead4eae6720483071
SHA512 f6e7a356551ddd75837bb1abe64a02afc67475782edf77d32f9cead277a947d14773bfac8ac2957f86f03f0ae3de345ac6e858032db531432681ecb325797f41
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidngnQ/tbw/2Mkjy6Fr7g0ou:ka5POZ3+Jt2pasx2+meQ/lFTjN4
TLSH
T13A65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 964593ccfdf9c1b38b9383aa845862bf298f880b83f9cd2792a34e24c54f17a2
MD5 136ea0e766650ccca3735280140924ca
SHA1 2020dc0da746e04ff2dc8e1fff82854963fe65a0
SHA512 280e36c7cc38444ca83bf27fb7a361246c6ac466ea664766fb89a632731e5174f351accec4ec50983aea66c1541fb0c2696bf51d2ba30e79e02259582ce80583
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkynQ/tbw/2Mkjy6Fr7g0oq:qNc/zEOVHFVQ/lFTjN4
TLSH
T1E5858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 00965ad339258bfe24be314acbb6cec7146cd5462336023126a78f636085d7ae
MD5 1778852f21ece3a1ab5172a4dee5435b
SHA1 5d838105fdfbf55bfe484f4ee624059ecc48b65e
SHA512 b9593ca27f674888eee690be856e2f76e8190d1582fa65dc535ac60f781c26aa45473742c0bee87bfd5d61faa44f22079ea03f689f9f274902df5d556f8cace8
SSDEEP 24576:78kNvNnaFeYhJNtmZBmMnQ/tbw/2Mkjy6Fr7g0ol:78MwBtOmMQ/lFTjN4
TLSH
T1C355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 25be4bd56d7ada5ebf050733f35150468fec0c7d56f24882c3f7332ea46b9080
MD5 73baedcfd449b0f7fb35c23d8c187b38
SHA1 630a653c372cb0aa7532d1388617d887eaf0df50
SHA512 b91123cd1001521a32eeb19d7dcfaf7332bf74e4c3086c25738c97bf33ceb69cc4a3936101aeb4a24f3e94774216773a761aff8a8056eba5352d7b6941541773
SSDEEP 12288:8HvUrBFrEjwaQeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:8PUr+NQenQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1C565E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 20209abef1eb3297f23c4fd0fff7a7010d41192a57853c8cd1524f615decf54e
MD5 831387075d695262fdaddf1cc77e07a7
SHA1 e322e498f70a2ddea05d7e38a91c56099bbf9c98
SHA512 6e3218167c0bdd88205d18e7f6d9d364b53266b310cab533563273fa6a516270be2eec93ddb8080510b0a9df0b2fd76427c0eebf88ec12e33deccaf996974485
SSDEEP 24576:XD3FHshBIYQgAnnQ/tbw/2Mkjy6Fr7g0od:XDVHeBIAAnQ/lFTjN4
TLSH
T13D75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/684-0-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/684-9-0x0000000002CC0000-0x0000000002D29000-memory.dmp

Download

memory/684-72-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/684-105-0x0000000000400000-0x0000000000555000-memory.dmp

Download

memory/684-16-0x0000000002CC0000-0x0000000002D29000-memory.dmp

Download

memory/684-7-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/684-1-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/684-6-0x0000000000750000-0x00000000007B6000-memory.dmp

Download

memory/1108-169-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1108-162-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1108-163-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1108-335-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2508-62-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2508-318-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2508-68-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2508-61-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2576-59-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2576-53-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2576-47-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2576-57-0x0000000001B90000-0x0000000001BF0000-memory.dmp

Download

memory/2576-46-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2688-327-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2688-75-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2688-73-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2688-81-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2900-140-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2900-331-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2900-134-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2900-132-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3832-119-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3832-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3832-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3832-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3832-109-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3832-347-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4100-155-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4100-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4100-153-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4100-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4100-148-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4324-43-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4324-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4324-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4324-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4524-333-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4524-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-121-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4524-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4612-94-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4612-91-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/4612-96-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4612-328-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5824-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5824-28-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5824-29-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5824-22-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5824-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download