c9ebf043af1e93ca47166462e1bd204bf2f41aa909a51043676f5a555b300034

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
Size 618KB
Sample260809-xhp22axsdz
SHA256 c9ebf043af1e93ca47166462e1bd204bf2f41aa909a51043676f5a555b300034
MD5 094694680c32278ec22ae3b6af0c37a4
SHA1 3c403881f55e244a5b211d67b1e3c981a126cdcb
SHA512 596adbd5a5539bba4c8cf8502e48a8b7af1448427b77c3bdb12a1e4402a57faec5fb303c25959ec737cd83e3ff8ae8b1ca96b643225a5bf86547cc760015ed2d
SSDEEP 12288:G20E6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:G20EMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T12ED42309F2822DC4D72BD13AB7D6AB72B162FC2D24705D6F4224FA392F74CA49D2D425
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5772	elevation_service.exe
260	maintenanceservice.exe
4340	OSE.EXE
1572	PerceptionSimulationService.exe
2704	perfhost.exe
4856	ReFsDedupSvc.exe
5472	SensorDataService.exe
2424	ssh-agent.exe
1652	AgentService.exe
2104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b7e3a53e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	OSE.EXE
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000312ca4223028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043614a233028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a8b33233028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003ea8d3233028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ef1ad233028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
4340	OSE.EXE
4340	OSE.EXE
4340	OSE.EXE
4340	OSE.EXE
4340	OSE.EXE
4340	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1376	2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
Token: SeTakeOwnershipPrivilege	5772	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1652	AgentService.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4856	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4856	ReFsDedupSvc.exe
Token: 33	2104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2104	SearchIndexer.exe
Token: SeDebugPrivilege	5772	elevation_service.exe
Token: SeDebugPrivilege	4340	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2164	2104	SearchIndexer.exe	100
PID 2104 wrote to memory of 4520	2104	SearchIndexer.exe	101
PID 2104 wrote to memory of 2064	2104	SearchIndexer.exe	102
PID 2104 wrote to memory of 5992	2104	SearchIndexer.exe	103
PID 2104 wrote to memory of 3916	2104	SearchIndexer.exe	105
PID 2104 wrote to memory of 5872	2104	SearchIndexer.exe	106
PID 2104 wrote to memory of 3860	2104	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_094694680c32278ec22ae3b6af0c37a4_conti.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1572

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2164
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2760 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5992
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2760 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 23e0c930b63cf4560de03bad88a9d2d671a68df38898c50807ed846ca86b6cff
MD5 94dfcf837f6288cf8f42a78ccc56f403
SHA1 20e1b2476484a992833c08852a66fedb3a3b9ecd
SHA512 00191934894e1e45019cfc9c6ba59eb93650d7e7be6e62d297b6fff46641e7fb537c05ef377581b346aa85b6bd95499288758498e53d4512a50ef6de7781383b
SSDEEP 49152:Qb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnCao+z30PX+:63q60jBHIt
TLSH
T1A1D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a64829fa83fb7f343dba33f5ccb4f82168d8b34fd1081c09bee6b3008067cb53
MD5 1e298ec8a9fdf9160b0eb1f73ce3909d
SHA1 a2df9a2dd8a9d3e409a7e238e8450f08b4921133
SHA512 15d567aeec33edb5eff9157b9461a751ac9ffb0960284edaad4bf298929247c2f77be528378ed2a260d2d094bb4ed019aeb251a253702986b0996fe14c791075
SSDEEP 24576:4XYfDtczAGMtpo+Hd1+OA6nNL0SYlX6a/+Z:vtcVao+z30PX+
TLSH
T11A05012873D408F9ED6B823DD9A28502E673BC554760E6CB03B49A291F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d221a24cb8ed0523e928e7644d562e8fccfa65566da5032d1ad9b89ffa0a5a80
MD5 63a6eff3e2ccdb609999cde4c42480c9
SHA1 6297a3032646402bbb803231f54e2a102cb35ff6
SHA512 3e1a16098196ea7df37995d85d9f0fdd0ed05c5042f111995ba9fa95a6392d37a7506e950e36b7663021c5751461ae0c1a9026028863d3cfec28df9adb169183
SSDEEP 24576:h0Le5ji0hmxNrMHMtpo+Hd1+OA6nNL0SYlX6a/+Z:hPji0A7oao+z30PX+
TLSH
T1AE359E15F6748731D073C0B9C5D2A68EE97230865B308ACB4296D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b32ee6431887ab988ce79722f07c8c734676dbe019d41db8592219d1568317df
MD5 20347a6b20902a3a338a65dba336facd
SHA1 cc4c29f767023f9d6bd954c95a3327536509aafa
SHA512 c812774da62606163a4453dd7c258284d261932e0ae69eb7a6309d6bcc52ef65e2568afb28b527842b9b55afce2c161a0dccb67cb6be8465819f2eb4a0c68362
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWr6q8wyuFMtpo+Hd1+OA6nNL0SYlX6a/+Z:x/ezSC6vUzPviHjy8ao+z30PX+
TLSH
T164755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 095c21f9597630187a365e8e007750da30f6dd824cc5b8372cd88f4a2b7ac5a7
MD5 7c887a9a0f49752ac8d644a41e30c6f4
SHA1 b87e75e727c96b17c4d8e795b905db5e3f2771d3
SHA512 b0401f95b2390e7cd9affc56f90698b3c69f8d8cf0257a6362249d058d227508ca9a4a2240818a145b98a839714d12362cdcf3b6306d22a62118b6bb82bb796b
SSDEEP 24576:AVbqPb88hv/l+biMtpo+Hd1+OA6nNL0SYlX6a/+Z:AVO88hXl++ao+z30PX+
TLSH
T16F559E65F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 77b501066dc4d9b5986a1b4e1cd0ba424fc041c705da7e0abe298af0ddd2dcab
MD5 5a5a2c84632f27bfc97d7b9872d09232
SHA1 aba7869577f6e6b84b00bfc2a0d68e15d2946c8c
SHA512 d9c451101e5ebc168b36e32858801efb7b7101335b70e6564301f562813502fab56f305bbae1124272b8e64098c77126438caabfadc2b9daf71529c9691a3b50
SSDEEP 12288:OjD6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:OjDMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1C2C4234CA18818C2FB7F913BB799795B71A69D1D78A4888780743E8D1FBCDA0E83D435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 cda92606465a8181d1f72035f704bac8bf875f60a5b11cfab5f463139748ad5d
MD5 0aa4452b416b4d5ec231ab45c0086872
SHA1 658730912a4a74784bba2f0ef8fb48f01fe93522
SHA512 374055176cdddcc2726181ee66250ce49fd294dc836efcbe40221eae4308828d2a95dd4e28bf029741f15975ea3fc8bde7672efee3545aeb93e73525ef1c1247
SSDEEP 12288:teBNUbTVO86UK6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:tJIUKMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T14A05CF3BEE28FCD2C27E9DB96B918640A77278304F6193CBD175820E9E235E05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 447b4cc4e9c04a3e2e266cb9de82364fcb84a2eda64694099bd384b96f68ba73
MD5 0c2341bddeeb343a988429b822bce7da
SHA1 b13e8ceda23781ed6c0ebbededd50c531d3ad13f
SHA512 3a6cfc99e2b06432a27c6cf46949c2b41d3dafb72c8ed140458dde47e280e6995cb2446dcc37aaa951fa70b3a9e40800ca31cf1ed9ce87ebcad9c604f60f1690
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THP:GQvGAdlCEL8c/RRNw5C5It
TLSH
T1DE266C656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 957d7ba4d81d73623428432b17698d2135f2c34912213a7a4a583bf2a987799c
MD5 92edaa5b5b613dde0b2ccebcbdce4641
SHA1 e46444c8dabdd795d9e0f381819ec5584a8117cf
SHA512 792404c5f513c77c845cea8954d5d438f0311ec418b13c00cf7075b35138b21c6d3b9a7ea2b003b185b31dbd7cdb33230f25dd478c04b1dd30f95ba7be28bacb
SSDEEP 24576:LSewsAjYMtpo+Hd1+OA6nNL0SYlX6a/+Z:GljYao+z30PX+
TLSH
T1C715E030FA74E432C37F0DB62B26D716246DB9204B6119C3E3B85E8D5A742D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ad923ff40b863a5d0d14c07aeaa84d19205ce50b29b9ebdf9f7debd655cb0eb9
MD5 f08102b9adfa9ad980a43c21848ae8a1
SHA1 43df63cd96a78235a4d3e3d826d45501f47d6ed5
SHA512 a6406676941cdbf90530e8604bab2226f4e673071c1ccac698781df922847a4c446b634e2cfdf76b3055a223243d4d00718caf1da1dd4963c7222637eb84fdb3
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHAI:WUEtQevvqc2W1cpV2RI32
TLSH
T1FB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1db6fed9e9e9517628d98eff6beee695fad9dcacf36ddcbd03b945d1fe02a851
MD5 dc18bb31775a846fc647a4dc8aee65c7
SHA1 04337d1a0f6a03abbe6d131008ce0debef1de33e
SHA512 095e1d4abfb4042ef831c92d06158a141a7dc92f1007e31e78a35823464277f60eb486f3126f06c1a49db56ab3acd08307e3d86a864559ccfa68f09c54dbc910
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/z4ao+z30PX+:woqtVjnmVIt
TLSH
T1F6D58D0976B8C1E4D1F6C37896A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0fdbd15772fd2ed7c86779f4b136049297f66ceac65c0be7fecb9beba2ab4c1c
MD5 189b7fb8bea7b87d9737754766f56ba0
SHA1 bf6d8b0ad12d4eafe114369b1fc7e553f9551193
SHA512 f6673abbeb1574581c4dd54c0c5a5f85164ffa6fdc2f2d6e5bbfa2fea45af558b8c62ee268188591645db9d9a83115a8364428de7197cc57af30955cc4874fc3
SSDEEP 24576:gAhGL2IFoiwtA5l7S53pMtpo+Hd1+OA6nNL0SYlX6a/+Z:gAM1Foiq55ao+z30PX+
TLSH
T1BB35AE80E7F955D4F5B3AA78A9B69171EA76BCAA5E31C20F1160D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fa22b944f88e49e0bb1f98a8c86bacdd63c1a91571ef095691bb2b6c0d05e6f5
MD5 cb16ec3b7603a12c2c1bd9212b7f2e88
SHA1 132f55b6bff0339d47ad836e8376c3b76a187955
SHA512 d62b5c67e7a72a511dd413ec951edd0bf9b79c2a37de43614ef14707767036ff7676ea6d0b0dbf457eb506e2f9feb05fb45b3aae25d8728d1235d0abf6a620d9
SSDEEP 24576:IwuXOWcMtpo+Hd1+OA6nNL0SYlX6a/+Z:IwsOtao+z30PX+
TLSH
T16205F14972941CE9EA7782398697D536F7F2BC152A21CB1F0370C65B2F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 6e35b5811f451def2d69eaa43ed35777415e6a3a3d701943e7abf5f6c9c24462
MD5 114d4c97cc1ed7088bd8bc605deca303
SHA1 ea25193f88b1b059015490df3c4f179ad8880b8c
SHA512 91f9471d5b0ef768f0741ad2eb484ceb506bba09b67357cd952fdc77d4cd2ba1af9a101d5e056024a41f49d5342e46d21aa3adcc5a43f6f55fc754027c741a72
SSDEEP 12288:j/Z1IyI6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:rZuvMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1E5E4124932C820F5E2B7923EEAE55646E3B2B82A277143CF013416991F76ED16D3D732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 084f5fd0a533f31bb5c511ba165e8347e95c9765494313fb340cc67bc225e3c6
MD5 1d19e552d32b73c18e90c930ce079a83
SHA1 e742c7939368182c751ea7064a4ae690db06007a
SHA512 b973cf04ca52a8aab1858d0afd062b0e16376b45209cfb82d31384e7d40ab40d409a85feacc2c7cc0834d5040c5433dfa2b6b561af3cd77066afff739c1feea9
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UL:rQRQyi36YOcPhLvw2gAf+PN3uIt
TLSH
T11A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 929113bf01710cd3c758a45fb5bc9c6fe5a738c87f74d83a92c4ad6295ee99f4
MD5 83e759242122f6af0c26fcc9dcb38646
SHA1 dd7526fcd86a12c1b06f73c48e2c129ac19bbcc3
SHA512 a6e83e38000662c11e5844294d810d0a77a7c493b9eb85fcaceacb557dfc336e8459e119eae65999c0f825d56fa18613a6ea8c7fa58ce25b0368b920bd9060b7
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UL:7QRQyi36YOcPhLvw2gAf+PN3uIt
TLSH
T1A3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fcf4ccfa6cc17c1b903659944041b07a06c51567dd77382ae756baa5ec15cef2
MD5 8dfc077aa356881e408f1537ed914b65
SHA1 b234bff5e48318e65f873909dc75158b31a03ed5
SHA512 8f7e3b1b3daf84901cecd3a3fdae648c42f442925e5e6e2037de6f5f7a56264058117e47ba06b1f9ed1ffa3152d45c8cc53d7fc071df3c6add3d0ce97f4dbc00
SSDEEP 24576:nwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0/Mtpo+Hd1+OA6n3:P68Qg55nhceWu7PNU3/oao+z30PX+
TLSH
T17AB55933B2F60099C45DE1769F4A972196D27C758FE0E3DB8111720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7fd20d28f70159c7cc8adb9b432a8f67df728ab2479958018fcb25a2af61e6f8
MD5 de71a21b784358af83c615fc50d91af0
SHA1 3594c3d8b22dbe9b6128db28c65350efeba022a0
SHA512 9b3d7b2a96c6d067dbd52c90224afef2ca9ba7599522114351447b6d6e02c37fb9d7b587eaf175465f3ca7469c17d2cabaec36f8334872cd76feed3bd3c3a389
SSDEEP 49152:j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99x:2y5112gYy5azzVva69nLKnhZPIt
TLSH
T129167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 550b7a7fa70c678ae009819eb12df4fa43d668667d95f2e72d90c17a57dae54e
MD5 322d3534c03813bd664b7d4ad0c14d6d
SHA1 a573535053bbe917a329c0e2a0a2df284605d1bf
SHA512 5a88f1dad0d1c6377c721193ebff612fbbb53f6d285fa56e748fd9166b130a94023754bd9df0629b8fbee3ee5d6953ecdffd39bd1cf663ed53be5143b9c15305
SSDEEP 49152:AB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl/ao+z30PX+:au6JmUxd2djIt
TLSH
T17CD59D13F1DA01E8D06ED079974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eefeebd8974b6f29716761a14541e16f6522d53bb155678a117f8394afc166b5
MD5 e1638e6e7e9acbea9f34fbd7cd9389d9
SHA1 0d7b5deb49f913d5d730b2f93d4bce857f6dfa32
SHA512 0fadf946cdb9284aeac2e22dde88de6b00ee0e39f88d3cd3768fe97fc4515705ef376c8a776fa4c35fb246d7907d30835cddc0c77f1379b9875bfdbfe6778b0b
SSDEEP 49152:X1hpsNoJpF1A6BU44CwH7R4xqao+z30PX+:XmifPkRVIt
TLSH
T1C8B5BE13F2D900E8D06ED17897569232EA62BC460B34B6DF0A9077961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5abe53142f2d1a4dd7cf56bbe87ccd2f2ae511c74e64a0418d286bf2cbd68c15
MD5 fcc6782639e294a5ea2bf6178e7c29ee
SHA1 e9cef1819c28280d90821d09714d2cce4f42f2f3
SHA512 2cdabafc0e8c8498d5b7b179a0080ef16df2b8de153198de77d865bfc99050dd96f05c4ecbd7022e15e67e648a48216779317cd9a07ee9d51f9aa843ae0ef21a
SSDEEP 49152:lSuZQIY0Be2KNRVtOnks6NMHqvao+z30PX+:r5dKvi61zIt
TLSH
T10FC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 17721a0865a6590cc0a5a6c996b608fe93d77b781a8e96fb17039dbd63cd98c6
MD5 030c31f1bfee228a3f5c788c0b1ec247
SHA1 3eb3d1a39f5990f38a1d94e70abec2fc24227fce
SHA512 bfd76faadca4716b8ee2b06dfe213fec02cb769db4db6639ff674453abba3eff42a0d0cc7cc47f6ea548b011dcb169216709866b524667c72c1d09389b290c23
SSDEEP 49152:1htSn8EApI0figXgiDn0AP5wGao+z30PX+:EX2iyphRIt
TLSH
T13395BE13F2D900E8D06ED179C7468632E962BC160B35AAEF0A9077561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ce28f010e481f870772bbeb7e6ed436d29b6c9c23c6df22f5d5d185a48c097d5
MD5 674d5b41490f46c7da65ddb4b2ab8d8b
SHA1 667ebf0290d0a4eae7dfe21d63a743dab8cec75b
SHA512 9dfe53010f110f141387532064e30ba17a11bb92ffe445ea625ecb2d7d7aa6bb0d8f4b968721a0ed4e69f3bed86ffb30e783453ee7487fa086c4c829d50e1cb3
SSDEEP 12288:SL6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:SLMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1C9C4234CB0891DC2F77BD27BB795658BB0A99D1EB861448B817C39492FF8EE0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 9742c6b5a439d10b00929b0ed1c4c7a9b1482e4610c9dc4deba9009fcc2302e3
MD5 2492451045745cbc56744a1f9a701d1c
SHA1 747d77cefc368816af94753bb18a0c079d4bc6aa
SHA512 449a08683c32c5a603656140e5a943f713f7175cab49aad78ef10bd40781c8717c6ffcb5667ec15107a11c81284eabf96cd0e2a52ef1f622f646e787d5e745a9
SSDEEP 12288:LU6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:LUMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T123C4234CB0891DC2F73BD27BB795658BB0A99D1EB861448B817C39492FF8EE0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 029f0c41848ed11db6301250832e25b9318ec234ea9d0b3f896edf2d869a5182
MD5 49e2c74f3ecde349ac2afef0f4c08517
SHA1 cd33a8a82ad239f10fdbfbc255170bc5b3d6452c
SHA512 1c5ebfcaf36d2843487e4b638c6ca3ea6d4dcf4d9d41fb5e904fdf4b112b91ffb048789af58aa08dd409185f712c9b90db5e836497d1ff9d3079e4f6fd278455
SSDEEP 12288:Iy6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:IyMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1D5C4234CB0891CC2F77BD27FB795658BB0A99D1EB861448B817D39492FF8EA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b31dadd4dc5b30eb8deacb2dd131b79a3ae70a256a07d5db1bb44f328ef361c1
MD5 3d4a76907fb4c139d756f04fbad080d2
SHA1 29dccf5a709c5006504892f9e18a49a6e747beae
SHA512 8ff5bf3651124abe43263201c91439853f042d734a6dc22431190f3affc9915e96a3f776c36495ab7747a1fb1d55618eac7491e1611928f8433cda9cd88f69fb
SSDEEP 12288:OVJ6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:4Mtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1F4D42308728914C2EA7BD27BFBA56547F1B5BC5DBA3145CF823429491FB4BE0A83C934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 2e568f9fbc087be30a2dbebbff2a7438d69a777c3efc1a270fc84ce2d163d252
MD5 c2378c1b03833494e9fe0fb59a0868c6
SHA1 eaab7911711a32045d5c2dd34f61c6a97b707308
SHA512 5060d062a36be89f34dc85c98ac1222549985dd9a74119b9e49d340288c04d9cf36a9187a0557a422f8b73588f684e0bbc216abb76b5a0567f6919c331bd5c3d
SSDEEP 12288:DB6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:DBMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T191C4234CB0891CC2F77BD27FB795658BB0A99D1EB861448B817D39492FF8EA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 e881776175412143b7c746b4e44bc4f75502cf810037712ad79e3da7a12fb8e4
MD5 e3ddbce98deab5115ac99734737c4f42
SHA1 71e5a40a25feb54f3235cda8166affa22dd7b1f6
SHA512 0012bd139384f8aaf9db79b9da9e638d8a66a49e91d75cdbe26b1e0d2a46fe0f5b205c7029523ba4cffe53216201a804dc71d800c2ab426eaf96421ef1f9d582
SSDEEP 12288:2g6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:2gMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1AAC4234CB0891DC2F73BD27FB795658BB0A99D1EB861448B817D39492FF8EA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 9501ca510a89de86eba6793f82f24fd975c6cea8cf43c430499c89b1fd39cd1d
MD5 5f0ded8a2a48ea20b39cfe3f858abeed
SHA1 4a576de0ea73e98727ee2a06992ced98ff59010a
SHA512 a5ba2259c0d56e03043c59fbe00cd239a063034502ce2fe736529f971adb63a24e0cd9afd4004a1a0c03a6a38972a692ca5f372c38b6b71b8c5131c3767bdef1
SSDEEP 12288:bs6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:bsMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T121C4234CB0891DC2F73BD17FB795658BB0A9AD1EB861448B817939492FF8DB0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 3a1c5b300cbac71bcf1a49dc8f1cc6bc2f38a25b956f13fab3627101711e4cb9
MD5 a7a459d01d36a590353131ea1432b77b
SHA1 2a2c37ff492bfaa7e4637e30a7cb8e346996e8f3
SHA512 75b846f302af5fe7c41c4a00c0f251d890bb5bf8cf7f253334b6d0e86cc3a7376cd6407adca65acae4e8e7e71b63271b14e106d42244b6172f666bf179754ee3
SSDEEP 24576:OZMMzFVSO0Mtpo+Hd1+OA6nNL0SYlX6a/+Z:OZMMzfQao+z30PX+
TLSH
T1F105F198B3901CF4ED77813ECA559906E2B27C1A1A70C65F03B8366A1F737A11C3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e8229caad68b98488342bca319a38bd7953442726a428821da616e15a4bc39fe
MD5 8ab1d1226c096f05a72e1239746f01f1
SHA1 7b752eb024765bc07f41f7e111280c1440da09fe
SHA512 928a7859fbfa5e03f13ecf3e49c2cc9b23a79911350354fad9175828fa4d4704a8346011568f69ada398f0455ad35cd22866e9d255b555ceb8804c0c842e296d
SSDEEP 12288:df6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:dfMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1D6C4234CB0891CC2F77B927FB795658BB0A99D1EB8A144CB817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 aebf4ff101687c490087e27a39a70fe7f30e4855e35ca0a4d546f0ed6ae02ef3
MD5 48f5b57d6ceb8dae558b0b0c63730314
SHA1 aac05338c9ed79ef4aa79442319eabaa6bb641e5
SHA512 5f7166df9c8c6ecd22f43e45563fa5d4afa39c66b60063cf283d56e96dd89ae4b11562ea51a6eafee591ce106066e17dface0325b8d9d835740857ce2f740977
SSDEEP 12288:iz6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:izMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1A1C4234CB0891DC2F73BD17FB795658BB0A9AD1EB861448B817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 9641c6a3692b1b811ccccd64a6b97113d239415d9947f81e1d6cf2b7f128eeca
MD5 7bd67bca262d93ec8fd6fd4c0062166b
SHA1 d4507ccb4609bb588943404895f9381c92304d51
SHA512 ee02a049274705d2bb06ede0b8b717e9046a06fb246f5a20f65ff16fa6c38e86ef6d5dfc88bece9b12aa3db089ddd8a38c2fae1824f0953c44eac412e00d3e5c
SSDEEP 12288:myPz5L8I6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:bzyIMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T10CF4020B729530E5D1779239DA921A06F372BC3A5B208A9F437416762F776E09D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e03a48f277d9abc3872ae8e7211e71d34714be84cdfe640da4096fba9d0e6f5d
MD5 d6e1381e853059ec18e93384b0fc50bb
SHA1 3e30ff5c4c01f9663fb7be1e6170b4ef9687186a
SHA512 b26bd6f853a876ae6178fb455565c1b9c54aec6368b955ab1ca2493571e70d55054674baf8a56add127103072c5c6342acfc567c8673502807804ea3116c2fe9
SSDEEP 12288:mf6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:mfMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T12BC4234CB0891CC2F77B917FB795658BB0A9AD1EB8A144CB817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5e701a53cb1c7dacc885cfc382b69b46ad8f0efae6375279b06ff3631eddc8c4
MD5 ffdc414bf7749c82a6c17e1f916f11c5
SHA1 43392c62198ad984b5c7416d8a024bcb03f851b8
SHA512 204d01fe038da030b2ea1b7ba128f27cf25798b12187e4e97f76a29a200dee181ade00554d92a0e132bb316753bb59db63a4b5cb4d99de84abe47a62ba3a5058
SSDEEP 12288:2f6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:2fMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T176C4234CB0891CC2F77B917FB795658BB0A9AD1EB8A144CB817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 c710d8d4144fe8aa63c6cf2d9604a2cf5fc2046997f85487188c50965179e36f
MD5 5260bd095207a59d91f966b9c6def0b9
SHA1 1f47a8a4c8afc4f07961fbe562a6c8ebbd4abf7c
SHA512 91e651f8b03287135c6a95201e020df60523c67d51685c70d7fc0784ffefc14df2134959aec6c235cbad0ef4eb72e4b4d537cbe72ee680b171fb1d46d10e90f9
SSDEEP 12288:cyPz5L8I6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:FzyIMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T159F4020B729530E5D1779239DA921A06F372BC3A5B208A9F437416762F776E09D3EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 7d6d9a80b4c0a6e99b443beea440e4d3153ce37b9a781b1575657071599ee242
MD5 f62f426b3ad87e459cd094847f98dfd5
SHA1 b5b41e63d9e6b7aa735e2e838727c399e1f23025
SHA512 f103ee8382a84c9b725ec700147dcf1748baf7497c0f6619ec63b44d9d8a2c3bd022b15ecf0f54e1000573891939917613aec97d8db7efe6447f5b93298a61d0
SSDEEP 24576:rT9aLl3z0zDCMtpo+Hd1+OA6nNL0SYlX6a/+Z:rTQLljFao+z30PX+
TLSH
T1F505F198B39018F4ED77813ECA559906D2B27C1A1B70C65F03B8366A1F737A05C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 e3645bd0ebb60a18274ef2a782750ff9e1f4e6d3a12214f24ea317d693ede15a
MD5 7f7018f177a257b2683a1812a712899e
SHA1 c7181201859f4c7f26aaddcea9b3fca47e32c83d
SHA512 6be2d1d4331397c3be4e95093b12c4d35efc4c153a0285715c59f1de35252e227f6a9de50adca0cf3142abe52e88ad49ab714fa2d58350d78e46af4d9615b253
SSDEEP 24576:93td9CHKy7GZOMtpo+Hd1+OA6nNL0SYlX6a/+Z:dtd9CHKyaQao+z30PX+
TLSH
T16025CF90F3E414E4F1B79A3599765512DAB67C5A1B31CE8F03A8261A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 aa7710f579de3dbc8ba4873732068736db216173bd6cbecdc5f8cf29e0f94032
MD5 ea3e7ee71046d1f992d4b2b57f45484f
SHA1 00e7ae84499587c549f78651c8f66f462205714d
SHA512 800d9b8cb133bbbef3d1c20e3d58fb91c7ee2fcfa5ac91b1e06200a26b59c6345113acb0a38a7ebe07a95f0d4829ef63f0f53fc75b33cecece0abac380518b90
SSDEEP 12288:BS6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:BSMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1FBC4234CB0891CC2F77BD27FB795658BB0A99D1EB861448B817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 71e06313a34a693ea73d330988da80049ca80e31ff8349b5f01cf2954318dbef
MD5 a0c5404c1f16adbc85c4bdec7f9653f2
SHA1 fa8745efd5aa5f3a5bd7b9a805604db36b860708
SHA512 92a6152825db75f9d7e66240901bfbd7482519cfbb32318557b55b8530563eb8e3cd4b50fa004092f961d74f42cabb430ab6c113a7fdd29b17a631b0e56ec0de
SSDEEP 12288:No6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:NoMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T13CC4235CB0881CC2F77FD17FB795658BB0A9AD1EB861448B817939492FF8DA0A83D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 29528d68a1528cae0b30c815189ca351a5a194329629e2a3a1ca605e57ce33cb
MD5 916814043a69e68dada93faaf4f4b1cd
SHA1 1ed21951cc832801bcc7fd1cc127477abfd52fc9
SHA512 3bf948184296d03b347278daa16462b58e905a6f213d7d2ee5fd68e296175d02aaa1d3488e645734247b86a0fcc631f7025c551b80b83913d5c085921149b6e5
SSDEEP 12288:L96ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:L9Mtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T114C4234CB0891CC2F77BD17FB795658BB0A9AD1EB8A1448B817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b921f0d774ae8c08bbbf8460e9db27dd62be39922550b6e2f6495593ed29313a
MD5 68e926beb99a5edb4a3b5e8cc1bb0558
SHA1 c4afa0b5fff5f47c6f0f4170ac3e0339412d9cd8
SHA512 47e7e319ac7493fe1cf376ead7449e8f14e45c43cfffecce417e1c8fd9d8353b87b4a20795d8c3d090ed68cb3c992ff04a775902781c52a8e510a4237d133ce8
SSDEEP 12288:1f6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:1fMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T144C4234CB0891CC2F77B927FB795658BB0A9AD1EB861448B817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 73388db69d19f34f735843d240abac898f1e4d1dd9a9e63b300249bb0adbee4f
MD5 f81cc758c285b2e75c64136ee17e714f
SHA1 4ad6f9d5a2d2626423bf2d8f4798ecdec350fc07
SHA512 b6fd32744c78194d5ba58378f60a94fbcfce5ec435b9946362020385f9cc3fdab7c8b8fedc649df6bd8b3c06db701f998948d4cd6a57546fd6f143ff5bab427b
SSDEEP 12288:kS6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:kSMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T163C4234CB0891CC2F77BD27FB795658BB0A99D1EB8A1448B817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 4ff15fe251f305f6051bfd36afcc16f200be8698cca34d9b3066045a6147dedc
MD5 bac5770b221be0c5109fade280641ce9
SHA1 2afb479a7f5cab97bb91a3a6b1dee979547fd7a8
SHA512 13e7790610275c000ff33b64ca8f433bf995fbc4d11596c6d9e2d96c4cd67833bf7011b5698fca86abfad509d41cedab592e3edd0603d97e8ecf86a7e02406ad
SSDEEP 12288:EX6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:EXMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1D7C4234CB0891CC2F77BD27FB795658BB0A99D1EB8A144CB817939492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d71a253ca59365e4d9bdd0b1ee8d1da4485a81d96afd7651d6f8a1ff9e68aed0
MD5 f2a4946e4161470b7737e2d968b7e94b
SHA1 315fc381b8ce4f69eeb3040ac70aa68328e1e5a9
SHA512 1b752b33fec17789efe9f3272cd02ae73af88a12e9a8a90ec17f9ad414dcbde435fea22f2b7a58f0bb8108e4291871e612eae110bcf814b274b27f208cab121a
SSDEEP 12288:tB6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:tBMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T18BC4234CB0891CC2F77BD27BB795658BB0A99D1FB861448B817D39492FF8DA0683D434
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c1f2d01d9fb1aa378d25e737d75dbc9c40caba3a0eb5583996ac038c93df949c
MD5 f8ec955fe68f346b5445390beb6e848e
SHA1 2b7a285fb5b00790fc0001ac89fb998b9a5387d7
SHA512 9468df9ad3f73b81926a26fdc8a736e41b148df504f361020ac9ae7f17c9d266ef73f38ddef6605489b8377a7f262338f0164e6197574584fdf87032828f298f
SSDEEP 24576:Sfwvok9RX6wkyAIjMtpo+Hd1+OA6nNL0SYlX6a/+Z:mMnYIjao+z30PX+
TLSH
T16635CF29EBCC04D1E1B7923D99B7460AF2B178691B31C6CF026A53AD0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1cad9acf39a4ef6b167c3feb2205709968d71ba3b0f9ca2669d35f2193bb48a9
MD5 f4300f1f855601049f0413b55ad073df
SHA1 e41d5b88757684f19a3902d3f4f6fe7c2b853b98
SHA512 1777782d2953ae695de479f78ef017897ddd28d3b1fb5ed0bad61221ef3865b6424b2b1298e8b4a155c7c797927a49ebfbda3d6fdb0cb2c62d5492f1cc48b2f0
SSDEEP 49152:PYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mao+z30PX+:pySzPOIt
TLSH
T1CB066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b9d8907c1578b8339c80b30d2ce03d8df3ee927fd575a90f35898b08fead7012
MD5 2c40c8bdd71903990520b59b93e8812b
SHA1 031dd46ae1530c67ee57574fbd2d12b88c7c6f45
SHA512 fc3eec98d364d5c6a8761c74df9601f0445a061675853a141707fc5658b57d1f2b64f51c9227d16957a31896ffb3e2a3a9f89e81547b4d510a96935f43746300
SSDEEP 24576:i47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYkMtpo+Hd1+OA6nNL0SYlX6a/+Z:i47JUQj4irIhCnDHUPfF/Wao+z30PX+
TLSH
T19265AE1DA3EC01D5E1BA927886154A5AEA71782E2F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 215a65292b2ae6a88b5acd1e39654aaa1e9f96e9c33e863187d10b6c8a1cb618
MD5 837537eb092d29bac13c6172823efd3a
SHA1 cc8a1e26082a4cfccfdbbe678f86ca0296925169
SHA512 eda45c4b6d4458e3aa099997851cd5466588f053525a9deb6dfe12298de876aea7a0fa68b4efb4f30dd92db389c66929771762e2c343d5b7c3ef71b257320d65
SSDEEP 12288:IGsfv6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:YvMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T1EAE40109D28802C4D16EA23AD7565A42B3737C2997E1C3CB52E0F93E1F75AD09DF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ba4274c64964c10ec4204b1cf60a4c5ebd032abbc68fa5a21a15d33a8a4ec627
MD5 3f4d959d43208b9eae3c052079c2674d
SHA1 24fc64a274181de2e2724c5cf6b4cec70ff12a33
SHA512 93d29746df6608bfc3af0b4634fabddd5e432fdd51a81500cb817e983dbb360690cb236eb96060cd0347f13a3dca1ead77ebf8fdf83398be3b8b6f836b46113d
SSDEEP 12288:kkW+CU3fGcpWeiksbC6oV3i4PS0BJdBfD7nxR+lHTufmhFo/v:kV9UPCe9s6V3iaSuJD77xgTmBX
TLSH
T19D351850766AD75FC6AD40321E32C2CCA7707D41EE05AB0372C8873FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 83cf21671611bb23c6d9ab8b273e3924660d69e758a0445e05b7d5c53b26a446
MD5 372ad3d78f896cb2606d2fb7bc527f46
SHA1 3989d5b41d68b5b04050322cd000fc3bd0eb23b0
SHA512 8e899b5a937351b97cee56821df607dd92c6da56fa6c17881b6fe16b8306e6827fb347dc69d1ef8df065998886c91621242cf2d092a1ac4799ce1c4cf89a8887
SSDEEP 6144:uE9D1JUwdRLyoMLJsyC2DuJ9Jp4DyNwvqjQ9u6tdapwb/C4kM5tigP16t8vIQ7NB:lFBp8Jy2ry0A6phR/9NSdIv
TLSH
T1E065D7819437E2DFD1F66032072A5B4CB7B4EC1677096F26B384443AD82AB25B1BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 d71073b4fb430bcdd427fda00ed7b08122657b6405379a15d48226f16d25ffec
MD5 af7048d85da393f5a390f94175f1edf8
SHA1 221cabdfb9559128f7d1730e9dd675e3ee5526cd
SHA512 5d4bfeb6e5bf353b4e727f82c3b2454e2fc923d7fe6525af91e361c4ef6bdee5ed82cb726f5a5c202977f6dab9fef66c7183f03bae6ab5441301199c8bed034c
SSDEEP 12288:tM7n6ftpo+wodqcfz+OfJuKaY5VnNL0ScLlXCDa/rynZ:GnMtpo+Hd1+OA6nNL0SYlX6a/+Z
TLSH
T117D42318A28C1CC2F77F927A7799A516715ABD2D7F5084C7D0383A892FB8DD0AC3D429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ca74d7220e91bcf384486dfebe9fc13c7ae6e651fe7c23b65cbfaf3d7feff633
MD5 26aa17c7bf3bd2da1489c8bb9848e1fd
SHA1 234b02c122107fde7e9504f01e628a7d1f4b852a
SHA512 ae56c310dada5befb32723aab3a5c30b68f37e3f9a181c7e2195027d318e8945532dbf6aa58b0e5bf85ce6d49d0c39814bc2ae1933426eb67d366eff91120833
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYFMtpo+Hd1+OA6nNL0SYlX6a/+Z:dgb4mBIBhGFkao+z30PX+
TLSH
T14F65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 06155d8c4356eb3ad94f1720c08aedf415f9f7e3b8268c85919f035f71a7cb25
MD5 ea9319279274dcfcf059a97fa86d81b3
SHA1 d4dd2f8882cadfb78ca1e9a1d66a62b37dc7fc1e
SHA512 d24a46b2571e33a56067216b43008a16dd7090b89c8652c3669fe053e477e97495052e5a413482f6cd7c7608a6c626f75e474263a94818ffc0347b91746ed18d
SSDEEP 24576:/G88u8FpJqH1Wzria7/m0Mtpo+Hd1+OA6nNL0SYlX6a/+Z:O7ZFPqVha7/dao+z30PX+
TLSH
T1E135F16572E101F1D47BD1388A864663F6B2B8251364EFDF06AC8B551F33AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 5082d0ecdda51e1f11621b40448d0c7bb1d9b65ff2285a4ab1cdf1179d62fc79
MD5 f0b73589395eab8d12f20844f8c3e240
SHA1 8a6cb0e5b68d4b5f0f3ebb3efcd2b874f4675cf0
SHA512 dac98d479a007f519f95f0d179146821bfd7e44b2743e8f1ac334945fdb6feb1676bb022bbac9f44e1bc300a2c68592a0d837a25722ef285604ae21b49d8c0b2
SSDEEP 24576:DPUr+NQQMtpo+Hd1+OA6nNL0SYlX6a/+Z:DJQQao+z30PX+
TLSH
T15F05E11E62DC1CD5E67AE17D9A828609F771B866171192CF02A0417E1F77EE8BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 548e7abfc0ccca6cdd1d456f1e6c521a4783a57296c991b016c1c390430e67cc
MD5 64317a8f482038ec2af48259e0fc423e
SHA1 7055ffbc9af473e92fa35a2231eff4787bd6cde4
SHA512 ee6f96dc4d4cd8fe4dbb1e4096fda7c707d83e1f0f100ab5fe51dddb7746ffcc79dedf03d51f745820745bb77a8345bbf8bc852bd4056746d3327ebc2f58d8ea
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgao+z30PX+:nG05lO43bHIt
TLSH
T1C9D5CF6E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9153be6da7fbde943c22138724688e33fdc93ae4bfc9182067db204dfaab1390
MD5 cb953ae73f0edeba3c290d2fd36df543
SHA1 513cd9a437b6f1f04c6666fc452965b03511fdf4
SHA512 768e32c9ffb6dc9cc2e20ea3d8ff9c0298de9083a04e30fbda1d00bb948970c3ff58a22be44e7ab35b9cfe4208766bcbee9a6763219e277194effb12b6737150
SSDEEP 24576:Kfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnmMtpo+Hd1+OA6nNL0SYlX6a/+Z:Ca5POZ39Jt2pasx2+moao+z30PX+
TLSH
T10565AF5EA2EC01D5D5B9D17DC683461AF5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 96a92a3698365b62411dfddb2e7d1b1d12f314a70915be6444963f8fd07b55fe
MD5 dc7d35a1a1104ebb9225f888d7a24d81
SHA1 033bce3babc3ad73b69ddee5716bdd4ff97a7774
SHA512 20a96a9b7400076c3ddd72bb24bf675ca731947f8c73c7afdb9fb94dbc21e0d36cfe51291eff2a459e399ff3bd6397d97055214841e5042c7df2f8ad2c01e455
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7Fk8Mtpo+Hd1+OA6nNL0SYlX6a/+Z:BNc/zEOVHF9ao+z30PX+
TLSH
T1D9857B1622E901E4F5BBE1BE89779546FAB17869133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4b7338cd16e7d2a3db9785d4a9d19e94c3c43face8640602242153d011736cfb
MD5 b9e425c1123d33242050d808f2f0f3bb
SHA1 538a343f19fa8e1df6e678deeb062d6f3888230f
SHA512 5250db00c62fea90e09a5ff286eec442ca23af940d70824294d68e71557f99c8616d6d8eefe5bcfef52d3b0cfc92c58380881b363763344cfa5076c5e956d5b9
SSDEEP 24576:ztkNvNnaFeYhJNtmZBmDMtpo+Hd1+OA6nNL0SYlX6a/+Z:ztMwBtOmDao+z30PX+
TLSH
T10855AF2EB6E806E4D1FEC6B5DE238512F6727861173293CB5290C13E0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9c2fbe7e28c05ebd13aac86500092a24f27f1e3c5cab0399106b98325286fee4
MD5 6969c4678ab518eaf6427bde6a3843e3
SHA1 e84da66b8ba31e0412fc7fdaced64f4ebc0a1bb4
SHA512 c4be9a0abe1baa68b66b131a878495e4babfde96cc45a2da5abfd06f4ca7cb7d9e2fb14fc2f1c9547accbbccc4f22697f4b34835eb698b96005eb49a3118d306
SSDEEP 24576:dD3FHshBIYQgArMtpo+Hd1+OA6nNL0SYlX6a/+Z:dDVHeBIAArao+z30PX+
TLSH
T1FD25E17DE69C04D4E57BD1BCDA638A06E27138AD032255CB02A491BA1F6BEE47D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-33-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/260-41-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/260-44-0x0000000001B10000-0x0000000001B70000-memory.dmp

Download

memory/260-32-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/260-46-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1376-0-0x0000000140000000-0x00000001400A5000-memory.dmp

Download

memory/1376-28-0x0000000140000000-0x00000001400A5000-memory.dmp

Download

memory/1376-7-0x0000000000B10000-0x0000000000B70000-memory.dmp

Download

memory/1376-24-0x0000000000B10000-0x0000000000B70000-memory.dmp

Download

memory/1376-8-0x0000000000B10000-0x0000000000B70000-memory.dmp

Download

memory/1376-1-0x0000000000B10000-0x0000000000B70000-memory.dmp

Download

memory/1572-62-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1572-60-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1572-70-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1572-277-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1652-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1652-122-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1652-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1652-128-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1652-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2104-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2104-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2104-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2104-310-0x0000000002F80000-0x000000000321E000-memory.dmp

Download

memory/2104-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-110-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2424-306-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2424-116-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2424-108-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2704-79-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/2704-303-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2704-73-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2704-74-0x00000000008D0000-0x0000000000937000-memory.dmp

Download

memory/4340-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4340-165-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4340-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4340-48-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4340-49-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4856-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-84-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4856-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-83-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4856-325-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4856-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5472-97-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5472-103-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5472-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5472-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5472-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5472-307-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5772-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5772-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5772-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download