04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
Size 1.0MB
Sample260816-pt9a2sdd24
SHA256 04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec
MD5 a8ca37c78a9baf2f1fc1ea0b314818e7
SHA1 8c1e7d2a4314486085bfe2096453b01f202fb49b
SHA512 72965f09bdf92159da6a4e82401d4ea88df9656c63cbe6897f79e8341335a11e452cc6ee86a164d326ac1ba122ab2d3032045e74505015707ee0431519c5c711
SSDEEP 24576:8VQVvA/1QAPj3i38WOz17qgXe4i7ojhsP5Lgrk1TWb4AN5:YepAPm38715e30jaNf1TWbdz
TLSH
T1E435D01AE79801A9E06BD17CDAA38513F673384A077299DF0390E9755F33AE4AE3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
7088	elevation_service.exe
4720	maintenanceservice.exe
4500	OSE.EXE
5472	PerceptionSimulationService.exe
5840	perfhost.exe
628	ReFsDedupSvc.exe
6688	SensorDataService.exe
6652	ssh-agent.exe
1216	AgentService.exe
3640	SearchIndexer.exe
7120	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb32c778957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	OSE.EXE
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	OSE.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000236df6f7c2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000697ea22e7c2ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a8e852e7c2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a48edf2e7c2ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
7088	elevation_service.exe
7088	elevation_service.exe
7088	elevation_service.exe
7088	elevation_service.exe
7088	elevation_service.exe
7088	elevation_service.exe
7088	elevation_service.exe
4500	OSE.EXE
4500	OSE.EXE
4500	OSE.EXE
4500	OSE.EXE
4500	OSE.EXE
4500	OSE.EXE
4500	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4552	04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
Token: SeTakeOwnershipPrivilege	7088	elevation_service.exe
Token: SeBackupPrivilege	628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	628	ReFsDedupSvc.exe
Token: SeBackupPrivilege	628	ReFsDedupSvc.exe
Token: SeRestorePrivilege	628	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1216	AgentService.exe
Token: 33	3640	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3640	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3640	SearchIndexer.exe
Token: SeDebugPrivilege	7088	elevation_service.exe
Token: SeDebugPrivilege	4500	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 2988	3640	SearchIndexer.exe	104
PID 3640 wrote to memory of 1856	3640	SearchIndexer.exe	105
PID 3640 wrote to memory of 5180	3640	SearchIndexer.exe	106
PID 3640 wrote to memory of 5284	3640	SearchIndexer.exe	107
PID 3640 wrote to memory of 3340	3640	SearchIndexer.exe	112
PID 3640 wrote to memory of 5132	3640	SearchIndexer.exe	113
PID 3640 wrote to memory of 6532	3640	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe
"C:\Users\Admin\AppData\Local\Temp\04242a212487d6f77bb5952f3c118b9ee1a1cd60f6431cb2252b0144948d4fec.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7088

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4720

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5472

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5840

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6652

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2672 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2672 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:7120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 51002e91467e11154c60c3d452e27dabca1cd2668c754ff0a03ce8efeabcf956
MD5 5cd8aea33182c8961bf96d4dda0eefa5
SHA1 00c94bc4df185bd7962a2cab485b807fc59f680a
SHA512 16bc41384b1f487f8e088232b20771b9d46514c58a91f79ce65692e4890f490e5d8afa361c3af2a114e715eabe4445aab50788a6a1743c3c0c2e87bb6f62f434
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9e30jaNf1TWbdz:53q6HjBQU023W
TLSH
T1E9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 9f4d94fc024c14c54b66208ad74d6dd36dac29268cc9918dd82cee44c9dfe381
MD5 417541b877efd0d3f1b2bbd30bd7c200
SHA1 15c0f0d5c34716997cf0a72f8de4cbbfdd768cd0
SHA512 7606adc2c22b5e4393eb5c639b44b9518f3cd97cf9a51ab7154860a6df34544d5c7c34d29fb9ff4df481cc823da5342b534c5feb0e4b73ee2219c96083346ae8
SSDEEP 24576:AXYfDtczAKgXe4i7ojhsP5Lgrk1TWb4AN5:3tcae30jaNf1TWbdz
TLSH
T12905F12877D409F9ED678278C8E2C611EA737C814360EB9B03E099661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 64c1a686457911d308eb9beaa472d91510162bd184edf688481ed225e687a543
MD5 5e6fa3e360112b0cf4e5172d04819a33
SHA1 e96e7e6e1c1516e72fe5ee23c6801f2c334e4584
SHA512 339360f0a29cb2d90ea061812c20d720306c102f7cd7937208830cd67586553428fcc3f0924e7c4127b00a88d3492800c3b51bafeb85fbf8712ab9274d53d14c
SSDEEP 24576:y0Le5ji0hmxirMZgXe4i7ojhsP5Lgrk1TWb4AN5:yPji0AcHe30jaNf1TWbdz
TLSH
T1A435AE16F6748735D073C0B9C5D2A79AED72308257308ACB4286D77C3E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 789120d177b801e4dace3d43c0b285062932278a303615ab9bc1c0f84a9097ca
MD5 1535abffd8dc8747f8f5a900dca43dfa
SHA1 1a0e59e88430270c5f7b3113b0e8240d2e94dfb9
SHA512 b04c04b469053c886202324664afd14bd2341b398fa5894e1f489f5ccea1d17fec2bbec35c72b42ca86c3a69e5543351e146ca87f11c9977223d67ce2146cdb6
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyuTgXe4i7ojhsP5Lgrk1TWb4AN5:L/ezSC6vUzPvxHjyLe30jaNf1TWbdz
TLSH
T14C756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5b6a9504bd00247f46928aae7dd27d8fb21ec3552d388af406379f5f93360f8d
MD5 37ef3e9a59f4270556b2970a95b9ebb3
SHA1 5dabd796638ffd1ed270b66062c4160ce9d9c3f2
SHA512 49f7ac8f6da20102b8b185faeae323bb51fc60d9f4fda1d60f3797dfc5f3902524bd97d3f9af74a3ad730a780c793ea57b9c42d8808915fa9d560d8dc9afed6e
SSDEEP 24576:YVbqPb88hv/l+62gXe4i7ojhsP5Lgrk1TWb4AN5:YVO88hXl+oe30jaNf1TWbdz
TLSH
T185559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4eb398fee5991e99b419fcda3ff26a852cf3e8b469c8180e4c2bd21befb77a68
MD5 1ca9a6d1bdaba432a274633db59cfc7b
SHA1 29caf93857e191e1585959a3972982bf5204a723
SHA512 e3001e2110f1a4834b0aeaaa8542495f1506f6cf2e70fc7f590d8e0a34ad0ebd9c7db74745a6dd33e4edad0a4a60dd5cd2994515900672276618d46d7d6d3c83
SSDEEP 12288:XRU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XR1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18AC423929F5449C6F38BC2F4A0F7CB91E5A11EC071444E6B47E0BE931CBC89ADAD8459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 035380e46259f5892263e7ed324689eb06d597a4071c1f10c4e686c0bff8c9e9
MD5 4555955c8ff26ad610e992b0cca51587
SHA1 89d0c9f7f85b02b3505f129f0d428b5cfcfc2579
SHA512 d254f929a30e75e04e655134bb38d19f294e865448c5bb15ff755536ab82a547149a284402c036ba7988cc014c32a12723da30e70c24900aec334c06e5c93164
SSDEEP 12288:WeBNUbTVO86Uh0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WJIUOgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1C705CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1fd7d21670a87841dd538d37ab499d3deb592ee412d77514cc0ab8bbc3fefde5
MD5 08f5ef4edd16ce0d69a6badb370fcf0d
SHA1 d756e7a081c3b598e0bc6af6e018d5023d79d3c2
SHA512 0dd849f914e413bad42ec3f1a9b66ff82311f419c9b6cfc93f0fcb8cdd45880a53cf0ba9285d2320d5b7332370ed7c2867b3bfa33cfac15bfcd0041fab8c4ab2
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THT:wQvGAdlCEL8c/yRNw5C6U023W
TLSH
T12F267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1251ee14e266a14c89b0673a542f380cd439dd66abdcc28f96b989f4539a2a88
MD5 c1ba818e7c5f2233078845712ffd4f7d
SHA1 bfdfdb243e11066c0792db67b1d9527a7bb612f6
SHA512 18626cd65847d5515120b8eae9a309786c6d86a95c119f3cab9c88b9e69897f8bcbc00f1d9eec3589d94a4656418f9088f4e65aaf8be470a3afbfb12cbd9063b
SSDEEP 24576:DdewsAjwgXe4i7ojhsP5Lgrk1TWb4AN5:BljXe30jaNf1TWbdz
TLSH
T1B415E031FE74E032C3BB0DB21B76C706586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 868e9b6d6fdf3c6c48341e547169427ddf67b4ac11016d54c0ccaf59bed1b67a
MD5 7c29d22460f30d9e42f7bb2c8ae4c98f
SHA1 dff726dc4bc58d33f6fa90710dc8b15479815818
SHA512 1207e80104b2f6cfcd123bad38c3b8cf2d4d5f75a3631a6773cb110bc50b1e379fb9d9f09158fca6d865c00d173ce08bd33d2092bb898af00d84823f9cdce639
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHPp4W:wUEtQevvqc2W1cpV2EI32h4W
TLSH
T1A0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 354c3f601d496ce8dbb1afe3a1e5a6bd8a9d2b2ec9f4388b7863e850177546e4
MD5 2414712b07e759562cc721234d46fd56
SHA1 b744335c14f18b6a8b05bd36bc71d5a0f6632b02
SHA512 a6effd031b344caef3751dfaec030bdffc5d074865de443ddc10288729ca11922f0ad3e830b01bbfd2570a6aee0c058998b7fba53a8c58ee8b99104daba122e6
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/z3e30jaNf1TWbdz:yoqtVjnm+U023W
TLSH
T1F1D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 077977b77c976dd9169775453fe1a6bc1e33346248fe551237e4df061a86b490
MD5 4844cecf468413ed13a0d348ef41c04d
SHA1 158eee9dbde04d145e8034b0ae50da6cd9584af2
SHA512 5e645f650acc7be35217644ac56344ef2b47d7e925a9aed3abf805ae71fa6d3601df07fdd40eb8aeef50207e25485381b465602418b4cb18992240045c1d91ce
SSDEEP 24576:xAhGLJIFoiwtA5l7S53XgXe4i7ojhsP5Lgrk1TWb4AN5:xAMyFoiq5Oe30jaNf1TWbdz
TLSH
T189359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 fc5bdb6b2af50f6ab50649e3bb69533a721385fe0071a41dd51ba4ef26516e37
MD5 1f47b1044b2bf178161cfa3c4cc3f970
SHA1 9f843ba29a7395bd4fad97cd1254f05f12312ed7
SHA512 0339d9febf84e870b19d2009e0394ac1244681e3dc3c7e8a63ebce2470bc478056776e7ea4fb5449889a5276bf8981fa74bab7bdffd98590696f0f07bfb8007e
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+Ca0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:gwuoOWEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B405F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 808959874f1b93f8bf5a5fe70eeb774966fb155134d481668ea669b2591d46bf
MD5 4a0bf67b9d2d062ced1b5c6386cae373
SHA1 c02ebf5c46ba709dd72f66588f2d311893034357
SHA512 9db43c76baa46355eba31703b54954b0fc576c033ac018e0d765f57f569f02b2788219a4c330d38ccdaa80e4a429b1043c16c52826c64dd371a0dff73ded405d
SSDEEP 12288:1BZ1IyD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:jZuxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T197E4129637E421F9E2978278D4F68741E7B23882233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 780e242927c55ef49f237807b512c8213be3a032a5522790850eb042ac491383
MD5 f4a30539ca0ce864c4501224685f70d1
SHA1 2ba3919577290b1913c0b71b5b4a9133eeb964c2
SHA512 45edc82e8f1da55eb1d86e4f208de66a0c1ba40b9c32aee87a4dc0fbf47a8ae71fb49f66c204744a752d9757287d8fd307220a035ea82ff15f64da5cf32fc29e
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:UQRQyi36YOcPQLvw2gAf+PN3VU023W
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 33295a74c3c8d952093e5a691daa710d47f49ed24572cd725690741efb9442a4
MD5 442b7f5f5132ba3b290e5fe65d14c1ac
SHA1 7aa4e5744b0b06fe50c56ed1ee950e7bd0f17573
SHA512 96a27ad0a3f428923d199e7f5c57747e032d81898ec1c52c39aa942d65d64047fe586e1fc43e509f2430be130e1d10adf69b3a3e7012761752d379b291811b83
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:5QRQyi36YOcPQLvw2gAf+PN3VU023W
TLSH
T15A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 79252f0963ca4f7f053076279da65b9bba06a091becc48074125d24ec9f0350c
MD5 b981307dca0f853b99dad28cec5a1a8c
SHA1 94bbb896fcfba2d111064607c0a8e29037594cd8
SHA512 9791253baf4cddf99b93a663343dae31f14de09dce41fc7a957f177efb0f0e3032f15cfc482c850fade9ace8c81da5678e8fdbc99e26cd5dfc97394b77f2d8ca
SSDEEP 49152:W68Qg55nhheWu7PNU3/He30jaNf1TWbdz:0thWRc/HU023W
TLSH
T1ADB54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a86ec73ef01e1c39aef781c59e7cd59168cbb2ad33c26d4eb69b3c970c9d4f77
MD5 2eeefb4ae389889f7c8a50acf3d3d261
SHA1 4fc91241170a6ce17fcbd653831e2f2171f9b1b1
SHA512 a06be0ecd637d63ca2d830c3d4fb849ea15f5b1edfd464c9c99584138c4bdf7a7e7d681fd57ea9102f67f68023669bafd7ff873d0c418b3dc3d133194aea47d6
SSDEEP 49152:b3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:+y5112gYy5azzVvL69nLKnhZgU023W
TLSH
T140168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4d0b39644862221cc02e8e215549ecdd8cbae7c0b76f4dee0f154108f465bcbf
MD5 3534f6f8263c44f68a244d73edb0dbbc
SHA1 78665801a46afa4614029865b2e367fd688ee93a
SHA512 9df4ae70d094e77522587b5b38d731824fea4feef7be40e6d06f1b50efc1fa2856bfe8428c2a9b652eab3d4fcd7a5df78b946f9ba7214d8aa54ad22cbd9fc6d6
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKe30jaNf1TWbdz:Lu6JmVxd2dKU023W
TLSH
T180D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3c53fc4ca4cfec2755624f0e5f96e6ed06ae2abff91eb02f32731e301e2eae66
MD5 dbba15efa08f95371a957c9e2b843bfe
SHA1 676658bde5a07492b739909d8c24a94e51cc87af
SHA512 7019a3c0f1418087d6fa45d906e7b9ee636580e3d8e60efb41e4996df7b3c3e6262ef5f490a2adfc0fa6d81561d4063e0943df8757254c59f42e6ac7152a8f88
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xhe30jaNf1TWbdz:CmifPbR+U023W
TLSH
T16AB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0ee09b716dff0e9b71a0fcae457dc33bbcd70214b98e526f039936bfb17bbe89
MD5 11bb2faf52b4f2220656ed7880e73cf9
SHA1 385f25c2a6ea658c17d66d1ba39c661c90fe0b18
SHA512 1196877a51c0ae460ad83e5597a6a942a82a98643b863e37de037f4cc4cf87148cd27248610c747d44478c4ece69138d9e98379f8c79e473c4458595d24b948c
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqMe30jaNf1TWbdz:95dKTi61MU023W
TLSH
T1F1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1c66ca02e0239b759711600abbe0d3fd97f93e2b7d312d17c7c2838ace207787
MD5 1a6ce95acc4137870fd0199ce4646b8a
SHA1 0171930dc4a994d33a621949ae41f63edac1899f
SHA512 0207c696482195a4b1407253e0159bfa092d2dcfbac4f79a1b79964868d2d4fc19951877e7ae9eb8a5231d24d0dd7d68156b47d94de4c00c6123878f8d6c1d32
SSDEEP 49152:KhtSn8EApI0figngiDn0AP5wte30jaNf1TWbdz:rX2iyphSU023W
TLSH
T1D495BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d0c16874f35e1ea19ec36d6cf267b38e2ca7e54552ed213fc2be3bd29e721552
MD5 e8effba3d3349f047fb6d5bc62c4d2da
SHA1 b5ec76ab2e00e5aae22fde053fc21e066ab3b633
SHA512 6df648a4f8bd879c22f5ec61c603902abe6b6b071b95f7c05f01de104a1a5374e4dc04fc64df1b29b60f234d34102a3e6387bb0156a9525282f2dbfc40131a4b
SSDEEP 12288:JM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B7C42392AE554ACAE34BC3F0D0F7C7D1E5A11FC272444D6B53E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 dfaed4842add96b21cf66feb3306418b74dd55eae6360b14f44b9def67dbb4bc
MD5 dc6c8b21c31e6d6883ad56e9743907b6
SHA1 ee974882ff344ee624e1274717954870bb42ecdb
SHA512 412b4793c824f3a410debadeb6a05324b466008456bdc0c073d4c191216cc70e351a124e20a04776b9601eab80a8acb135ca09e5cc840526c60c3bc1af147f78
SSDEEP 12288:nf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T191C42392AE554AC6E34BC3F0D0F7C7D1E5A11FC272404E6B57E0F9531DBCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 15fd309479b9add4768a45d60414e3aec04b96f983a3d7f1dfaf006e3cb3d2fc
MD5 63ef229561727c70a561270e9ca1ab5c
SHA1 ff480451a1372beb7566c10b6e148d27f88f1d2e
SHA512 c8d587da16bc6b75256e5d9cfc0e2bb2ad7d11a5e1f32d1403871c464a63288e5baf5f7636ef5f8535814498bc1c432e574340c4085f73a8ea227093d4f6330e
SSDEEP 12288:lZ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lGgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T103C42392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404E6B47E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 95ea35ee889aba86023fce99e3d82c4fe6696fd255c6dbfc13650c271aa17e1d
MD5 75e18b125ee3434a14e793ad90a3473f
SHA1 8e13076021ca6fb5f71be966a60bd8c5588f2638
SHA512 f126105f6a99f20a6465628566743d77817c7714ea6595656546cf1b6e97dad3c1ed3b6c16bed66f7c9cba3e0f80a232841266c4ceabc556c5fb57e8adcad738
SSDEEP 12288:yV+0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D0D423926F6505C6E287C3F4C0F38791E6F13EC173114BAF47D069530EB4AD96EA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 f9126ffbeaff41c475cf9e74d51dee1d2077d5ff1f28660bd5d8f74671186547
MD5 11ef61cbeb67ae44188305f7f6ab76c1
SHA1 72825622e95abc03ba4d92502f2545147690295f
SHA512 60bfdd995b75eb6921f60cabe20bed7df4620ec7015c076568918f104414d61221e68be9d158b09235d8a1e6af84166cbd9e5ca41a14bf4f327f08ee7b5e5f47
SSDEEP 12288:ym0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:y/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16DC42392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404E6B47E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 514e309de83dc9111e3855a078da48c9a630f734ef4d69bd893795fd8fa7f82c
MD5 c9c4e69b1fe04eb67f971d462b16d847
SHA1 ad1f6b911789ac768518923c7a4206b077efc92f
SHA512 d7f05f7a86ced7f1b70a9dad081296465fa543f3521baacaf601152ff45fd9fc2979edb0c0f82fc2e1d2ea9875f4a9cb7d1f8a1f9554831effcf42f7fa4d8c25
SSDEEP 12288:RL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T130C42392AE5549C6E34BC3F0D0F7C7D1E5A11FC272404E6B57E0F9531DBCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 325f4d7e1d0bc4a9449e0044d0aee47843a9038241fd901192f3ec14d9114de6
MD5 795a3e8401140d456f5fd31f60f9a553
SHA1 f571100357fa9d167dc14390b01a887859fa9c1e
SHA512 425c235fa64ae8d617983309f0370539d2e9843f89a611b4d8bf76e8341e4041a58fb34bc52bd3ec1a2e62ae9cbf14a5026db0c9d59593a32d5cc444a890d76f
SSDEEP 12288:TH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15BC42392AE550AC6E34BC3F0D0E7C7D1E5A11FC272444E6B57E0F9531DFCCAA6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 b50399a56724442aa35f52ff76cfd50181c145cd151374bd1f3d065fd89c98e9
MD5 7a38d10f81b643b82648a2dd33ebc5c0
SHA1 85a99f58f84b0fa3ca5ba11028005992fa728402
SHA512 9c357f493aaab2e77a11ad8969417a1cb8956a148e0734547c2b6e033123f95f605ee12eb880294791ee041e790421f495cfd1860fe31bd6276e694fa8c37058
SSDEEP 24576:sZMSzFVSOsgXe4i7ojhsP5Lgrk1TWb4AN5:sZMSzfve30jaNf1TWbdz
TLSH
T116050195B3500CF8ED67827EC8A68A06D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 98c7bf4184fe7672f23c83f9459488ec1edaab7cc38a04cc931f771b4b8ba9b5
MD5 afb4844b9637d52c7a9726b0dacf600c
SHA1 8c33076651d89f36578852acf9c728264dae2235
SHA512 bb9455f833cdc3d97eb03c6427d117bde6d878c978057cd84317130d1bde20b9e6ef3d55288f1d916792682fb3d3bd6281c76bcec29fdc85bb6fd4b472660b67
SSDEEP 12288:mg0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T156C42392AE5549C6F34BC3F0D0E7C7D1E9A11FC272414E6B47E0F9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 7ef4a312a92eb2e3e57ab334f6cce8b042a5034e0ff9c1217d5e0692b2ed348f
MD5 c5cb6d70135693419533b3f336354652
SHA1 b8b5ffd583a0275e599e0209ee6ba403369ed732
SHA512 d7995019c76e3ed4ddc3169f1a3a5b4897ce4df70b88069426556970ffdec261af0469d2103142ae05f175ac58bca4fbb0184ea8d43bed8717f6273c09df5de2
SSDEEP 12288:0k0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0lgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19AC42392AE5509C6E34BC3F0D0E7C7D1E9A11FC272414E6B47E0F9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 7da236f96579ca2470cca95508d21f2851df9951f57ea774be5bd4d501c59c2f
MD5 166235516e3ba730cab4682a7cba1ef1
SHA1 8bcf10785fa13044d565575623e22cc997f9d6ff
SHA512 c3fb117e0fa1d34b306021406c52df07c257b01aadf0c9cb1e1972322257d19e20fed0163324acdcf4e7bf814e179527f5df82260ae41308fd897bcd232e11e3
SSDEEP 12288:4yPz5L8D0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZzyggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D7F4025777A120E9D1678278C4E24B42F7B2787217208EAF03A057732E776D19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d004bf72c97fc0a50bdc8ed1be6d5f02ca8e2d6c69213c185ad9e7bc63a45343
MD5 dfba3cda7f6a5af4f956f494350ce515
SHA1 83dc78cc20a0ec6be2c4a6fe987deb0f99ce77a1
SHA512 2e78df7f159ee86ecd362228ed10e008c2458517b46e8634db5d37bcca1fca8ca31d84f78386823ad3f8f70ae46ee42ab77f727450dd1317a59b3fd92b50296c
SSDEEP 12288:Ng0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NhgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T113C42392AE5549C6F34BC3F0D0E7C7D1E9A11FC672404E6B47E0F9531DBCC9A6A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 e11e2314e6b887d1ff0903c47aba9cae282c0a139586845472c82b330dcc0be4
MD5 e060f0e102a4fbfbdd4f3a7a87405a73
SHA1 7b33d75af4810c2e011f1dce1d01f1e1a9f6ea25
SHA512 1916829277f00df88e55ce45e9de8d638eeef9bbb23262e4bf53bca70977d836d32bf398dbbcce4b52d35b2c1826b13d1548af16131c6df5136841add0e4bd05
SSDEEP 12288:og0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ohgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B9C42392AE5509C6E34BC3F0D0E7CBD1E9A11FC672404E6B47E0B9531DBCC9E6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 8f410b543f216d8bc24ce03fa7bc99572de5ceb6ca6562cad16a37ec4a499b76
MD5 096a1a87e5cc879d8ae42dd8556ed77b
SHA1 060704549382d421b80fefbefc50a6a51d5cc84e
SHA512 51848cfd97dc72ec179d1764fc0cc42cb3ab8e3d1eb0049f9cdeef8609867495b20c3858a0fb0d3cb11270dc164259f7f68998f70e453a4a09c806b100127c78
SSDEEP 12288:cyPz5L8D0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FzyggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F6F4025777A120E9D1678278C4E24B42F7B2787217208EAF03A057732E776D19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 897e0c8fc475a45d779b432308b991129d337ab207c4caff7e7f5a7766977b74
MD5 82f55608928e02f37026c5be9661eb82
SHA1 4f244be52387349632f3c6aa76fc92813094301f
SHA512 d2fad212cb36ad6b6750937f5b6efb228ee7ba874f3074403013a00d02df557bb5de8ef2ec284a65f271c9d15f1fe8dd1896dc970e6ed88ae9d3b85c37d38988
SSDEEP 24576:yTHaLl3z0zDWgXe4i7ojhsP5Lgrk1TWb4AN5:yT6Lljqe30jaNf1TWbdz
TLSH
T1CC0502A5B3500CF8ED67827EC8A68A06D6B27C560760CA1F03F436675F733A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3c992510f85c6d3e1f8d6573abd89edad0e96ff5149c9cd5018d9f3ae025cee3
MD5 ab3d5b8700fee7491a26f9a157c4243f
SHA1 033f467e4fdca8b02f7bf75e82103fdddfef79f0
SHA512 e96adc7f3b3e5f77d79416a976cf616195b6a6ab70237f5d2b1bda8b4077edee419bb445ca594a2c300a3f0547d7d6355ac9c97e2017a65d8fc350bfaa57b0ee
SSDEEP 24576:037d9CHKy7GZigXe4i7ojhsP5Lgrk1TWb4AN5:+7d9CHKyave30jaNf1TWbdz
TLSH
T1F925CF90F7E414E8F1B7CA35C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 97c4bf8e9d5483d19fdc2b8f441cb986b567d9c75db395588e52fbaf5607d2a3
MD5 5d4c99fc0c73605c2a8b2ab5e0c424e9
SHA1 ab2cd186f99a841cc1a541f02deb650dca75d475
SHA512 f9a5c323ff3d18e370a8b9bbe7bc93dcafda5d16cbc3a55bd0d85e9dab6e270649b2714bb6a9a313e89afe6198a0d5f104bb31947a0d0b1bf1ba6a4da32b1710
SSDEEP 12288:950DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9mgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15BC42392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404D6B47E0B9531DBCCAA6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 0d9a59dd06a05fcfbb3cc976a8de465d27b20447ce3e16a3d0d4c9dea9357321
MD5 484b37244d8920002fc673cc683f7ac2
SHA1 d570b521a54754089770b603fd765208356439ba
SHA512 f7436d396424e7c0f2eb11555c28045bd9a68b3241fbd8cf2f178db1a9203649e9abb163c420c7665d2bc1da81d7dfd87483a6c7241f667936ac4239ee34affb
SSDEEP 12288:6j0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6AgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16FC423A2AE5549C6F34BC3F0D0F7CB91E9A11FC271404E6B57E0B9531DFCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 c3951c30b55ec9af269ad0b1fabe91e648ff151dfcf09b4d6a58cc9f39bfcb21
MD5 667c185970fae379c7c6807bca8ddaee
SHA1 8118c609f20db137f41940c2b8e5543ce6387ced
SHA512 b526bd2fc3ccfde009496947cb240739246b7d62b772b8af2d4c20b5ef705e6facccbc93bcd0ccf7f7c98857d989010a787b0356f2448fdaa35e0910cc48ee5c
SSDEEP 12288:Ei0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:E7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T167C42392AE5509C6E34BC3F0D0E7C7D1E9A11FC272404E6B57E0B9531DBCC9E6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b7f94e108f339f0941cbfd4827c082cf86d2fc1538e9e2dcf2862f4c74995e42
MD5 42e80125901d6e5e89034b5b006c46a2
SHA1 70eb7dd7e732c0e63ed3c58a2d43d6f1ca90569f
SHA512 30bb0e6a31f63f1f8e2f7e083d03e04a6e000a461b168dd8c4bfb51644646ce6c2236b162c40c7c0021c92302fb0dd1535bd711939fb692ef1b3fe27d9de5f36
SSDEEP 12288:9g0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9hgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T110C42392AE5509C6E34BC3F0D0E7CBD1E9E11FC672404E6B57E0B9531DBCC9E6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 dcc98575ae58340b32dd49a407e1faa50f3f88efdceedd826deac859cd5205b9
MD5 549172c4c1293520c38d5ee26bf89bd9
SHA1 e54cdc8b264e0a322001ffe78fafdd01f071bf29
SHA512 f6af49e6aba90d8105c8e4ed7d392d60b1584b55a5f748efa8bfc87186b2110735ca8b9c56dadc44b91db17600561ef9b873496021de260859e22a5f55c21e98
SSDEEP 12288:V50DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:VmgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19CC42392AE5549C6E34BC3F0D0F7C7D1E9A11FC272404D6B57E0B9531DBCC9A6AC84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 141a9d0337d45eb18e9cba646c9d442d257be1ac85414c3dbfb30127e14de854
MD5 c5c9f5b09edbad0f61c87c7fe36d2d09
SHA1 ef2434d8e7755e31d082c0adade7e4bb5cc954d5
SHA512 4df7694097bcdd07f34a2e93b35a6b8d066563ecc939101919b28e8eb41ff3420bb5f0b910ffad97314e9817550a861a110cf5b9153d56dee943a7e848fcea18
SSDEEP 12288:5I0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5pgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B1C42392AE5509C6E34BC3F0D0E7C7D1E9E11FC272414E6B57E0F9531DBCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d3cdfadd54b7589e1d727904706de7e61c239d431984a536670942d163d199c9
MD5 11b9105ab007cfbc95a4d3f2697868b0
SHA1 901a8f2ce8748c29ae912cbec49ce0be82056273
SHA512 009de279190ff3aaf9f4b6d358cc4760ea94ef9e1fd5767d1ddeb57c2156fdfbb86a5c40185b751c91bfc62be3fe152d380d9e59b40d9eda6887bb0b64afc12f
SSDEEP 12288:dm0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:d/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14DC42392AE5549C6E34BC3F0D0E7C7D1E9A11FC272404E6B43E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 076d5b15a1f0327c7a5cde5903c624e56b1f6242178364439cd06d506d8f7a36
MD5 6374f5d614aaf769490e5596827c8932
SHA1 0e4d73635b93c68b5a3fdf21fcc380fdfc304fcb
SHA512 86290f2343cb6c285ce5939e9cbb152669622562bbddb407549422e3cdd50914ab8e3197118d965dd25e0fe2358ca772373f23e12f951bd613a76518a923f875
SSDEEP 24576:ofwvok9RX6wkyAIVgXe4i7ojhsP5Lgrk1TWb4AN5:QMnYIAe30jaNf1TWbdz
TLSH
T15835D029EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0093b71c3596c385ebbf9042d78cb7154bd7b965ab15b033d419ae0bc9053c5d
MD5 b6451ba883ca9938bc208406ab3aedb9
SHA1 5355a874ccf73c7ff8bdc5c736053d91de3e6726
SHA512 53ee0e54312da88587aff9c28bb74948b8d158cc5ff24884177e6d283764e020298614a1f8f14e6f2c3f0c0d7688d09c511309003d5e625e59330787d0ad8435
SSDEEP 49152:xYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ne30jaNf1TWbp:ZySzP1U023W
TLSH
T147067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7516db1c17e6d2d416abf9fa3168a9900bd78e8fba3e8bf5dd6737d4be216fbd
MD5 b795a9025581b76a0820fb22abc10516
SHA1 ce1fb011fd66923869cd48510ce0ca231c2eb3b9
SHA512 73c2e1e9a6390e12feb4fd527990b567187cfc7709b37863966d52a7dacd29cbd8fd7ccb9dac674bf2fa8f383414a147e9852d9a75a52aa07c575c13fa5b9d1f
SSDEEP 24576:x47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcgXe4i7ojhsP5Lgrk1TWb4AN5:x47JUQj1irIhCnDHUPfF/de30jaNf1Te
TLSH
T14765AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 39ffe6f79b703bc72b0a054304aea014476375eda353ca3f86fca8f3c95424a2
MD5 f648788fa8af3b64ce5a9ee154284b1b
SHA1 de5d7d2809afd1dec999c3a5d17f5140f65710e0
SHA512 da730b2d2cb61aa291a7e943eb986d4b082b63b629c854439fbe0b5bdf98e3f72840c987e8f80ee9d92f7eba6b466276e52373aa3a6f6b7256da0ac63f64efd4
SSDEEP 12288:4NsfQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BDE4F15AD29802D8D06E92B4C3968A41F3733C5193E1C7CB53D0F93E1F79A949EE9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 db69d7b9348539064b5ae7b40d3abdafb120fe622e6968fa2057fc52b3f6b85d
MD5 0be402360f453542e8de8e3cc57a759d
SHA1 a53752824afeecefa9e24913f300672654f055d2
SHA512 34856045241e3f1900d884ba0027f5cef11b02066adea87eff5a06214248430a15de1347942342364755a99389be8d9e8b45f4d4f146d8b48a6276c595c57162
SSDEEP 12288:OkFBM4U3fNLqrZv3v1pxWzwM2eCY5r/roezIq3:OkFe4UPwllpUuABjZzIQ
TLSH
T1CB452950766AD75FC6A940321E32D5CCA7707C41EE04AF0773C88B3FD576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0de4766a1d803ab831a5f72bebbd1258db8c4192eb08b22246357a14aa4f6479
MD5 7b0b59f112f32d3235adc846c05115be
SHA1 bebc670b2933633953e010ba16480de6c401f472
SHA512 b143c7b8e95b57e1be7f9d16c35fc8c91e64261a02975b4857b47ab0ff7f9e544dabf01fb1e8b29c895658a1904d1729c59a4cbd26b3a5c62f18a45fbc8f1c84
SSDEEP 6144:tJFqY1Z9TmsXZemXyKemyOQQ2GU73zQ/yWc5AYPptMxqPptMxN9XUBQV5349+cR8:rsYmsXo6yD2QQ2d73c/yWc5A75349t8
TLSH
T13665D8816137E3CFD1FB2031072A5B4CB764EC46B7496F667388453ED82AB25A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5a6f5532ab26e49b3bb1c0f0f8bcfe968532b39238188e670571ea6d10b45d39
MD5 ebc09ca7b5e6eb603a005c3849ae6041
SHA1 f53c5d3be349c22deb859567228dcd3f3d7f6a07
SHA512 1f2be7d20eb2481ef992f20e5b48622bdddd3a6b9c20b91995b0ea2ad0c2b6a51859b3e2bd57d83a32b149b739404d2f65c57b40068bd02c527024f8cc2ace2a
SSDEEP 12288:oM740DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:p5gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CBD423629F544DC6F29BC3F090FBC760E5663EC0270089EB92D0BA9319B8CD99EB4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1da6de4e874f741419279c06b8cf1805293b9d4b9b7f9b4006029378c00d2f9f
MD5 87a1f0da71b9f6689216ac011c18aa6e
SHA1 efcaf4c45687da3840b9d03cf5654e9f8d6106b0
SHA512 2ad6df3e97b2c4a917cbbca08fd5eddac164723e835a9982722b109b5209680776334b68aefff06e13e99a4861a1ea225c5dc9040e2a3a9057bb781bba18a386
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYTgXe4i7ojhsP5Lgrk1TWb4AN5:/gb4mBIBhGFze30jaNf1TWbdz
TLSH
T13565AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 16e028a631cb6790a6219fc202f85e878074bf55f5620a2a9d70f88d56b3c9ab
MD5 1a81940f806682f784b5e282c4f57304
SHA1 140d87c128de6280ee1eb98cbc35be44fe16be43
SHA512 fb0a4cc2574535581e6bf5c6747d7e64955607009c740a3c2cdb5a4957b9c6363fe2bfaf578a1ddf32584d8a8f9c10cef8b16dfbfd1f154bd19a059bdb4c2b48
SSDEEP 24576:RG88u8FpJqH1bzria7/msgXe4i7ojhsP5Lgrk1TWb4AN5:07ZFPqVea7/Ce30jaNf1TWbdz
TLSH
T15B35F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8e790f09833551223e4a5f3f9add5d18708dede4f32efe6c4389a5d456e68d08
MD5 9d2edaedf157664bf82a493d62b43256
SHA1 8eff3d63c62fb8d07a72a0832f9055e4a2e4d7f9
SHA512 508b074cbe561861731e975a5068767bfc62f68d3ff04752c394e8fdaaaf161efeee31d95f5ef9985319a9083de40dc41f1b16d8b2fe5cab640be1413752ffaf
SSDEEP 49152:UBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfe30jaNf1TWbdz:3G05lO43b4U023W
TLSH
T1BFD5CF6A62EC11F9D1BBC17CD9C68A0BEBB23815033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e428d2db732d0500d2bd1f8d6767393756fff956088c3041a26a7598f7cab67a
MD5 1a4754afffc319b467965753c0ffba69
SHA1 f5e9ee8d3faa20fa04d0573cb0347c0cc425e5e0
SHA512 7a3ec19c46da89af3472e0b3dc4dd5197dc6255128c7024bdb3df7109fdf3a89cbec01ae9c4056cd30e5db508bfe1593acef5088068cd8fa8b580bd81e6dbe84
SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnqgXe4i7ojhsP5Lgrk1TWb4AN5:Ba5POZ3+Jt2pasx2+mHe30jaNf1TWbdz
TLSH
T16865AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 04cbf1cd74222bc169fa121aaf3ba1fc34a5777a7c6b0ef841fc70b4c9c9dd01
MD5 72aca1c03971010f06fae877679f16c2
SHA1 d21151b8fbeb0443bdc21127f37f2bf875cd2d77
SHA512 42ecfbb3355f04517fae30f6c2c95277898aacaf10392a1aa9e099fd5aa1a329300df734c7c860df15837b90631834733fcd742fdb698a7b0c2a1327c7e5d8b7
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FkkgXe4i7ojhsP5Lgrk1TWb4AN5:jNc/zEOVHFie30jaNf1TWbdz
TLSH
T1D6858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 df7648fb2f184980b9655bae74b6a7b3588fef2bb882716090d0ef27828fc694
MD5 7917dd5dcf63b58e87897813b985f592
SHA1 b005732e6d390f32f2ac5265c65f07b1ee344c84
SHA512 ad3f2a62b99a893d25b5e477844d722bd910602f0087e6b5583faa91a50406815f3730e6f8819adfdc0c0233b40552417dc3128198790d1cdeeb391d19193564
SSDEEP 24576:G8kNvNnaFeYhJNtmZBm3gXe4i7ojhsP5Lgrk1TWb4AN5:G8MwBtOm+e30jaNf1TWbdz
TLSH
T1F955AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 fbe69a0b7315e110c81de4a53fe2523dd325141bfbe7d528268a9a97ce5dea61
MD5 4b579be1caf24dcf220b32edd92ee5ec
SHA1 2d65d1aae14f1895797a89ace7b533a3ff8097cb
SHA512 3c21e38a1d61313bf69f5ced94ad3278d9fbd597aecece6c8b0d41726deea077de6ab62017378def960bfa6a2094ab155aed772b9c84803d1769e95ac3580efb
SSDEEP 24576:aPUr+NQYgXe4i7ojhsP5Lgrk1TWb4AN5:aJQve30jaNf1TWbdz
TLSH
T16605E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 01831158e48b788938321c343b1ed9719ec8c18dc23dbe2bb6c5a6478e181c4f
MD5 58acfb1c1fa5daaac1dcebeb52649f35
SHA1 069c437003f8c0dcac457523bc110ae5f82eb429
SHA512 f46f67ea993b00ba6337f5a8f8c3e4b0a7b9f425129dccca7628bee1e482a3e98a6fffb8bdcf2e44255642d6d299a3a1ef54d56e724ddaa38c22c5acfdcd1592
SSDEEP 24576:/D3FHshBIYQgANgXe4i7ojhsP5Lgrk1TWb4AN5:/DVHeBIAAIe30jaNf1TWbdz
TLSH
T17125E17EEA5C04E4E57BC1BCD6A38A06E77138A9032156DB02D0D1B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/628-319-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/628-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/628-87-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/628-301-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1216-118-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1216-124-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1216-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1216-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/1216-117-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3640-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3640-134-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3640-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3640-140-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4500-47-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4500-261-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4500-53-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4500-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4500-46-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4552-28-0x0000000140000000-0x000000014010C000-memory.dmp

Download

memory/4552-9-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4552-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/4552-0-0x0000000140000000-0x000000014010C000-memory.dmp

Download

memory/4720-31-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4720-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4720-32-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4720-41-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4720-43-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5472-299-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5472-58-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5472-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5472-66-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5840-71-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/5840-70-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5840-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5840-76-0x00000000006E0000-0x0000000000747000-memory.dmp

Download

memory/6652-106-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6652-303-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6652-113-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6652-107-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6688-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6688-304-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6688-100-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6688-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6688-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6688-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/7088-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/7088-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/7088-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/7088-15-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/7120-326-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/7120-385-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/7120-333-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/7120-327-0x00000000006E0000-0x0000000000740000-memory.dmp

Download