6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
Size 1.9MB
Sample260820-lcajlshn21
SHA256 6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e
MD5 7851ed616ae4a57bab6578e74f7649dd
SHA1 8958f07662fd34eb8557f916ea021d6e00eb1aca
SHA512 4a841894098dc604d019bf85e7a83ae143405b9d70f0d936827d004455f82753a2ce3cf5784a702b948d69e1baebd763f8214e404ccc492b1170ce7c8d41730a
SSDEEP 12288:K23Jh2CPCcnWZ9bv8XqFS2yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMk:K2LlQvkDrCaEzwAyujOhcid/RrmpF
TLSH
T1FF95BF0267E505A8F9F7A73899F69121EB737C855B38C64F0298416A1FB3F80CD75B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3468	elevation_service.exe
2836	elevation_service.exe
3604	maintenanceservice.exe
1900	OSE.EXE
3360	PerceptionSimulationService.exe
6080	perfhost.exe
4428	ReFsDedupSvc.exe
1608	SensorDataService.exe
2712	ssh-agent.exe
4272	AgentService.exe
2828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a10875ebc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ff810838530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070f632c58530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a03e00c58530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2f38e848530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005308d6c48530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc3c2d828530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
3468	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe
2836	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5000	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
Token: SeTakeOwnershipPrivilege	3468	elevation_service.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4272	AgentService.exe
Token: 33	2828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2828	SearchIndexer.exe
Token: SeDebugPrivilege	3468	elevation_service.exe
Token: SeDebugPrivilege	2836	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3572	5000	6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe	91
PID 2828 wrote to memory of 1204	2828	SearchIndexer.exe	103
PID 2828 wrote to memory of 4600	2828	SearchIndexer.exe	104
PID 2828 wrote to memory of 3992	2828	SearchIndexer.exe	105
PID 2828 wrote to memory of 2384	2828	SearchIndexer.exe	106
PID 2828 wrote to memory of 3768	2828	SearchIndexer.exe	110
PID 2828 wrote to memory of 5428	2828	SearchIndexer.exe	111
PID 2828 wrote to memory of 5012	2828	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
"C:\Users\Admin\AppData\Local\Temp\6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe
  "C:\Users\Admin\AppData\Local\Temp\6b503fde649a6a22407cd5e01080c62426678aac87300c21c39aa3a08084166e.exe" uninstall
  2⤵
  PID:3572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1900

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6080

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1608

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4272

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2828 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3768
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2888 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2828 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bd1bf170873d5c24d96d5fc57e0ce43b80e1f694a15170fb08b119b5978e1e73
MD5 684a4707494bff4c5dfc9dd462150974
SHA1 c9668f24e6d24f6fca18c78669b4b9a0c45011d7
SHA512 4024af6c5b924aaf8c8ece010ed8f859b6d87e22e9c3900e8ff1b5a1f3646bc5be4677b1ae74001157b8a441cca5d7d82d83279f387f9236c14b56cf10df1e0e
SSDEEP 49152:0b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn+CaEucW/Rrmp:u3q6HjBinudRSp
TLSH
T12CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 b075519072c591c06475b6473da55a2af6be03d9ca627cc78bf253542ef1bf32
MD5 1f7673109b9bfa8d7b32845da2054958
SHA1 de5d98f5a4cc1855c26e720e8b3eeb0d9e3f92d1
SHA512 98dd7ab71a9585792f04af87e40792f58b5eccd94f678caad823fe925b7f502f28c041643bea323fbbd6da8741718b0f1b44fab80191b9f0fb27454bf42ecd69
SSDEEP 12288:51XLsswWkxy2lRq2czAeyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:XXYfDtczATCaEzwAyujOhcid/RrmpF
TLSH
T154850129B7D409F9ED678239CCA28111EB733C5547A4E7CB03A8A9690E333D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c3d449794f21559c112f01128ef16b1a4aa475fa159145cd71d80716454e7ceb
MD5 24d843aaaa8ed04d969d00e2eaf12892
SHA1 f662d4750036c66797726615151b4770b1167bc2
SHA512 ac740af64285fb8c58f7c29ec369615e120f011e0067e2408149b7406ca6d222067fa35d5efd56398f754e0be72d20c85608587be1b26d0d3c6aff72fd082e72
SSDEEP 24576:z0Le5ji0hmxCrM2CaEzwAyujOhcid/RrmpF:zPji0A8VCaEucW/Rrmp
TLSH
T19EA59E26F6748331D073C0B9C5D2A69EEE71308657308ACB4286D77C6E67BE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1d7431105d5c417fe9162c02ca8b7c13ff6437edcd08edf8938b8b76e16d6d01
MD5 be69a3705643700c11b73b3dfb93d43f
SHA1 d01625c4c6204e3d9dc95d9a24ca4ba33a474547
SHA512 6befb3e8bab9e0dfa68561f999e2cf639c97ca2b038e5dce894b2c648d8e33a0cfa806c76467be4ba9511a618bb424a2fa81bb94bba1da8e0c9a71391c63c261
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyu0CaEzwAyujOhcid/RrmpF:B/ezSC6vUzPvxHjyRCaEucW/Rrmp
TLSH
T11D755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 20f6963494606a1d171501ca2558bbd0253a667eb455861b9e60797b1af66b57
MD5 061a4199d36537287c9c1b40655cce28
SHA1 1cb1851f3aac571fb98c9d6dd4872953a8fd1aa9
SHA512 d5ff24e8e55b98edf3190ab8ecf9e8decc4c2548701867fdc518de8759289206b99dbbfddffec570bd488b0457804d1b4f8c8b974864a4b5462c075bd3b51f25
SSDEEP 24576:uVbqPb88hv/l+63CaEzwAyujOhcid/RrmpF:uVO88hXl+SCaEucW/Rrmp
TLSH
T1F3559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 0b725420be4e0a5f26cced882b7d38f5f89e94faf30e5bd831397e07a1432b76
MD5 d0123efcadaf8a64481789337c84b40d
SHA1 5f802e63e80b51a7bffa3c5f01b9ca7110cc1a29
SHA512 23431ec5ed280d52b4390f743ac77abcbf7654c14e081d2ac1160d3df48d7aa3ee9c0fc81e5d4fc5fd8d468fbd133f3569f6e039ace06e9e62f65a77636c3587
SSDEEP 12288:HEPyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:HEaCaEzwAyujOhcid/RrmpF
TLSH
T110752337CF8997B1FB4A27332CF61024DB562C96159ACE8FB16DF6AD44BC6C0C849121
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 b9f0b514893d85fa3b2e845b31c70552555da9dac2177d7edb1787038022dddf
MD5 6b9ba97502b93cb3f13176ce622e5409
SHA1 755f1f74abca783cc03c17c4e3e6e1e886551cf5
SHA512 b883eda757fc15a1838d72171bff48a522cf53453deafd0437457094cf99cf0378b66e4823228fb234d73fa76a0029cdccf5f4971fc7b07c0504b6280e7e30b2
SSDEEP 12288:BeBNUbTVO86UKyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:BJIUPCaEzwAyujOhcid/RrmpF
TLSH
T10E85CF3BEE28FCE2C27E9D795A918200D77278714B6293CBE169C20EDE235D05D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 42dab295e5948a1da21d2e552d333c3b538c18212fc5ef271b1801452a6a889a
MD5 34f4645229d45bb6089cf45b86da899a
SHA1 fe553023b53222e0397789362460445278db7a14
SHA512 8ff858d8465d01d66fe0598c568c4ec659a10687a61a8b21f366a7637b7f94f9a05dcd90768e0942c292c08e1b7c76d5d9fb96f8dc62133b258c8cad84064ae1
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THs:8QvGAdlCEL8c/yRNw5CfnudRSp
TLSH
T13F267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 c36977520c903a6146250f880bf438ca4b1cf5fd2ac600284884a661b9375813
MD5 d5cf43e25e38ee02d722bc3cf578872e
SHA1 3c3cea3597e7e8766e21dff1a9cfa5fea81be34a
SHA512 5b129d65386c7e8a6bf7ae6fef9c0dbad64f49317a4a1609463909dc46c8bbecce1ccb6ee6828cf28db465d78f24ed81953c48ba7e689f29f2da2ece691020d7
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAjkyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm5N:jdewsAjFCaEzwAyujOhcid/RrmpF
TLSH
T12795E031FE74E032C77B0EB21B36C316546D79604B621AC3F3A89E9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2eb496a22200ec9f60f6ef502d8514cb28dbcc5cc0329ad926fcc021f47dc969
MD5 0ca607a6f65221dbc51c1b4c0d801359
SHA1 36cb876df338359734aeb5d7cc311e4d59eb0301
SHA512 d9a2254702faf1767339b5e945d36f445363107a752ddd21f364a7bc7208d09d6860b88cf139a58cc45f01e4593848be1d7a5d5da7211a11451b497471173a63
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsnFp:LUEtQevvqc2W1cpV2EI32sn
TLSH
T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e7682fec67f0db97ec718ff925a838350aa9286176e7d4b2874d9e3c0de13ed4
MD5 27ade9a93e102b9aebd3a2081b6679e6
SHA1 a9bb3452c2c82564bc5946129acb2808e44d8b2d
SHA512 b7b3f82eb508f0dfac3508051398dfc3cbc0eacf848c87ef0524e7004e1f58623149c5e5a5043422e1cf445c0aa0666014a4abda2f8019bae8f6a52c5854fca6
SSDEEP 49152:GCbRquA/m2yL5zLfFiV+XenmE3/zlCaEucW/Rrmp:roq2VjnmLnudRSp
TLSH
T15DD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3eebbbd4414a96964b13b26fc059703d327306bd97275fa3fe49ba1ae1e4ad5b
MD5 3a17fcd2c46699bc9e9c78f5ac11c90c
SHA1 2efe6f57100ea8483dc9cd2b22fb5043224c32e8
SHA512 373437da3f54eb691085cac2e57b3730714373ae302e51a485da617c4f640a58099ad228e5b5e47d25a4614b740d2149641c223991257249ea095dc6887c7cfa
SSDEEP 24576:rAhGLJIFoiwtA5l7S53gCaEzwAyujOhcid/RrmpF:rAMyFoiq5wCaEucW/Rrmp
TLSH
T1D8359D81EBF955D4F5B3AB7899B68170EA76BCA65E31C20F2164D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 9ecc16cce496f6f0ea7aa0ee9d3da963ade5664aee3e654bee0e0e04d79a3e00
MD5 48d33f4f6be5c744b1da92763de82241
SHA1 186aad28e2403425f1c0e94430ac7e37375be0f7
SHA512 67b0ccda2d566de0154565010dc2cb7988afc99e5f0051577d718b09adfff00266bbad4ecccbefe0efb7be8abf51b38a147f808aba251823380167542c0441af
SSDEEP 12288:bmw5HEjsChNyBFgl0WDm+C1yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpD:6wuLOWxCaEzwAyujOhcid/RrmpF
TLSH
T1A985F14A77A80CF9E967923989978135F7F27C022A25CB1F1364C65B5F37360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 3d1d77e72c9fbba6d402e8ffc7400aff0d3e3bd104ca3e50c0fa214eec61f1c7
MD5 ea8e8430e2419403aa29104f12097ab3
SHA1 390ebe09b52e152d8269b10cef0d45a1a42f4aa7
SHA512 eaf7f08a3b2dd1b976b3fe769fc9b2cbc2c3eb21476dac9877e5b4acbe070a420994be8781edd59b38696eddf9ddcf9353a620854cc77d947e0b50c75cabddd6
SSDEEP 12288:tSZ1Iy0yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:4ZuuCaEzwAyujOhcid/RrmpF
TLSH
T13D75126B67D862F5E697533A8CF11104D7B23C52237683CF2268A26E1E76BC15D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 58240b36fe44edd8428723cbb599aa30c0f07813537b79f45cb02da14af2e68e
MD5 4f18658094703e854c224cbc7e7ca548
SHA1 5cd5e59c8c66ae1ad31912ba2b156924075a884e
SHA512 986d8b7b86ba2581efab9234a8ce13edfd46269914ab3feacc1da383093c2df40bddde5e24f76a6ad8b26fd38e8b0c1fd89e56acdebe0fcb45671d440b0022dc
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:LQRQyi36YOcPQLvw2gAf+PN32nudRSp
TLSH
T10F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3cc40f2b0a51a3555d39d5e1067dbd42c34a1dce070260f6dcc56c16e518a4a3
MD5 ab148c05cd0ab26de549452974df3606
SHA1 d412678126940af40143fc6f2229864fea485d4d
SHA512 e0f385ebf9d06a132766d388da84931d1eedbcf192a8041b6c850742ee80c223923264cf19c67def00462c5b47eac41ae878415b9fcb4d77de151840124178de
SSDEEP 49152:cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:zQRQyi36YOcPQLvw2gAf+PN32nudRSp
TLSH
T1FD667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 36de824d4c95f39b76c89f2124ba1042f09cf7061ff416526fd54a49f1ad6744
MD5 ba3ff25887591482c6bdc731046a76c5
SHA1 637d227cd69a63b4b32425b3c8b1d10ae6f319fe
SHA512 140e9cc489ee607e524230025f504208ccb10f393b572394eb0c0fd5924f81519b74d1b781cb91240cec87ebd643752126754952e3d2e95265011620ab791263
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+CaEzwAyujOhciK:B68Qg55nhheWu7PNU3/VCaEucW/Rrmp
TLSH
T19DB55A33B2F600A9C44DE1769F4A873196D27C758FE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f29617d614e8a042efbebdd6efacab4146349a3f5407fb689f7c4c44751e35f2
MD5 2018dad80d59c5d4d37c6fc7be91da58
SHA1 6c720195bf364cf757ad6f2e43d8901ff73e5463
SHA512 ccec2269142c86e01111a7805585e4cca69b42f11dae545e1b7c3cd3379d86d9395e5b0025df5cfe4ea9c6e7003ad8fd3eadd27039e6293d5a630e8dc5dc5c4e
SSDEEP 49152:r3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99a:uy5112gYy5azzVvL69nLKnhZ5nudRSp
TLSH
T19D168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6d040c7973f96e4af7ffbf891834967758e00f2ba1d198a524dc1f81f898c5bb
MD5 0c068b7f575fefd46887774500df6096
SHA1 6e56a6050e2ee91ed2a1287b07801620b92ee707
SHA512 4086dbe27a0f2841f413a5a37d9ce8eb1e5c8360b6aac326d8888ae4b73b349e79a6131d9beecf590149e3736994e9327f5d62b6fdd3813f7beb4c5869b2a422
SSDEEP 49152:5B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glkCaEucW/Rrmp:vu6JmVxd2dfnudRSp
TLSH
T1FAD59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 af7fa6634e2f7c7024d209397da483ae8e60bf0dc1b6ef79f3ef0ca7f0dc3ddb
MD5 4dfb52428325394df6fb21be540c475a
SHA1 82ce78d57725c88b6cefc371057495c619c8d591
SHA512 c34ab3e78eb3e5116e1b6e552e3df3a62bae107ab6876948367f134dc0458675a85e1392ac787b9e62b3c6a097fc971ae103af59fa01590952b3543ccf817d22
SSDEEP 49152:y1hpsNoJpF1A6UU44CwH7R4xvCaEucW/Rrmp:ymifPbRLnudRSp
TLSH
T153B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 41d925914347e064791cc9e17f571fb623d52ae0debfff109d3e25c29f8ea05c
MD5 37e9729c9726db28fbf76fded94f1b2f
SHA1 cfc496465cb7b1c8a2440dc26985cac08fdf5910
SHA512 094140aaaa0682740978b79147fe35467af6611ca93c44d4ec2db1b4f475c9da169a390b744e02af3e4958870acbd180f186d1c0279703367ceb16e32f7e9656
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHquCaEucW/Rrmp:T5dKTi61NnudRSp
TLSH
T1D0C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 203cb48004a94f194bceb66a76fe4fae7ab147f439848e6dd5e20035feb23d31
MD5 c904c942c0d37a5db7fdf8f50a3476bf
SHA1 f3296fde2928385c74b1cebe6756a11c4585ed97
SHA512 bbbd61fdbb74e0e32b74b4632ebfcdb15e2931dae9234f3061a593bf206890adac79ab966db1a88bb99b372267a5161ebb7f0de4c23c7b18c06307ce7aaa2522
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wTCaEucW/Rrmp:CX2iyphXnudRSp
TLSH
T1C595CF13F2D901E8D05ED174C7568632EA62BC060B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 1e39ebd4f4df2fb6003aa615d2215dd7c522d1e49a50fb04d1d77d24c6611f28
MD5 a8977ad412fc07d36e1a257388959f93
SHA1 757ff99832e73b9fa8f65dd047fb15a18789fbb4
SHA512 abcab6c91518d0b966fbabe783402d15b8ec3f13966d6497eadc54e6f11376dffe920d53d7967d516766ca5928604f09581ff09765629b6810f6e48fbc6190f5
SSDEEP 12288:xHyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFuZ:xSCaEzwAyujOhcid/RrmpF
TLSH
T102752337DFCA87B2EA0567331CF61068EB993C9776AA868FB65DF12D44B87C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 a8475f8b026e718876bfb65ac591d47d75e1b5fa6305acf7e4eac4738c13136c
MD5 6393cf7214561d4907792e52d0eec5f4
SHA1 105ddae7d9c7060d5d5aec87e8b882f9eb2d06de
SHA512 f255262150d0cf7b7d49746412684e852928b0fe240256ce30a35554af2ec2fdcb46ba4683fb67b0d52ebef980a507874ef1aea725ac476ea46a5eac40505c34
SSDEEP 12288:DoyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFuZ:DZCaEzwAyujOhcid/RrmpF
TLSH
T131752337EFCA87F2E60567331CB61068DB553C9776AA8A8FB66DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 34dbaf2989fa1ea9095a7e77b4fe2be60072dcf2522acd23941d24faa4de37b3
MD5 8eb5555cff2cdd86411f56e400435fd4
SHA1 b3ab199c224a02006d4c67ad0c0140c914172831
SHA512 2f5a0c3537b3c56461923f15ea77fa6c47028b4fb3869056698510f084f84d0715c33bafee1b49c7f45974a8a001f2b45f3d103225ec49ad6058b3fb5f2f887e
SSDEEP 12288:tCyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:tHCaEzwAyujOhcid/RrmpF
TLSH
T158752337DF8A87F2EA4567331CB61068EB953C97769A8A8FB65DF12D44B8BC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 a2ab357e3b44d15a5392b00c30bd74310089babbbe14b6aad7d69a9b10854e2b
MD5 34d8ed15aebda93590d1eb0db3ff29fe
SHA1 68abc7cad6b1ec274809c07b6f72c02a9fc25a4a
SHA512 e7069c9174c077a95797c7bf7ee05114220826dca917ddb35b06388a890d5fbc5cfa52f9ff3185b2c2cedecbe655c62f26b4283b832cb0e46e5e166ae80a09ee
SSDEEP 12288:TVhyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:GCaEzwAyujOhcid/RrmpF
TLSH
T1CA752327AF8A43F1E956E7324CB21024E7B63C966776C7CFB61CB55E0CB47C05869620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 ea67b8582f44424c141b40f31baba9482f00202aa697325c163b19359d286d7e
MD5 7001a25d2cc2fb915c071b47c7df2f6d
SHA1 20b72f3c28dff5a544f32bcb53b9fa45db5a1ba9
SHA512 6897e6fedf208b2b496c4563b62f96007d2c83a8127d0d580f7a048f9a92befd97c6d4e838e3fcf01e1cbddaa4d31abc3da3c0e00f953a2e600d39a8841590c8
SSDEEP 12288:eJyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFua:eoCaEzwAyujOhcid/RrmpFK
TLSH
T1A0752337EFCA87B2EA0567331CB61068EB953C97769A8A8FB65DF12D44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 560b7418a991d7b1def81da1241cbe223d0a2c500ba173d2cf43d96f771c8416
MD5 868a6638315e937b2ce97fa146ee1477
SHA1 5afa3fd8ebe12e5940c10a9b1ac2d257235dc58b
SHA512 c393993e22f67717109a5a6f87a26aacaa38a4e1411303a9fa2876e2e427832d36e15dca49c7aa32846be611343d682c0a9325afa743dba271211a4d00dd7129
SSDEEP 12288:PcyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:P9CaEzwAyujOhcid/RrmpF
TLSH
T1EB752337EFCA87B2EA0667331CB61068DB553C9776AA868FB65DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 c368cfa85244e35f374a85351c03b4330f02110ed5adedf21905f9f666f9eb47
MD5 426ab65d57797243e9befbb33c5b551d
SHA1 5b9e1db6373087be182120fffea99cd86fe33e6a
SHA512 95cf6002a3b1f6e5a5653b25172d7cddef1ef2799fe2ed64f124e3614fc84e503bf36428d036331def8505b8255d12d6777ef1896881bf44157f9054e194f42f
SSDEEP 12288:aQyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:aBCaEzwAyujOhcid/RrmpF
TLSH
T13F752337DFCA87B2EA0667331CB61068DB553C9776AACA8FB66DF16D40B87D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 7ce7638ade651dff9d7f9ee3863c48710500ca198bb0d6f394880d1e981be14d
MD5 1f569ded12a5b4c58d8c4adaeab862ba
SHA1 0d70e863297530137ea64834c45344f37a243d24
SHA512 f7f66f631ac82a800103a844726b8f49d297edf88c43db5e010ea7b2a6c558946667a6fd13e0c386fc20c14bc1e8b17aafc180125adf1460b8674b5dc17f8149
SSDEEP 12288:XiZwbazzFEoS2cPvyIyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:SZMyzFVSO5CaEzwAyujOhcid/RrmpF
TLSH
T1398501A5B39019F4EC67823ECD654915D6B23C5A0BB0CA4F13B8366B5F733A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 8f1ce7d20609a2c41d7f2d9df6ba45ad80e3dd29c14d233128091d8224c254b5
MD5 38079dd4b0e2f5848471e6e331fb36d0
SHA1 d76f70b4798453c58fb424c275508e778febea6a
SHA512 b60cc7431b3a075a9d87c680e89551b920398b4c9b2d41f4c32908251c44b15a7b3704e3c5b47971ac2b491124eb78d75a57a19a14d3324290bd830ebc4ca147
SSDEEP 12288:/jyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:/eCaEzwAyujOhcid/RrmpF
TLSH
T1CB752337EF8A87B2EA4567331CB61068DB593C97769A8A8FB65DF12D44BC7C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 42a68ec1c2b95a489a213fdbc485116435ed3987e5b0c334cb0442f1ffa15c0c
MD5 a65ac49d4ab507ac0b95deb1ca07529a
SHA1 964d4cb7872ea04e7fb595963ffe30dfd2f8c837
SHA512 16eaf1c50aa7b7b30336f33c457f9bbb23659fd722f4a37aaa0ca4768fa0e795cc4ca90b9f8a9d9f403eca10d1eed3044f21a9632be9308133d3b412f35435f7
SSDEEP 12288:cfyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:cKCaEzwAyujOhcid/RrmpF
TLSH
T10A752337EF8A87B2EA0567331CB61068DB593D97769B868FB66DF12D44BC7C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 d42c250cb17f003f39fb95edd8c3bffd87515da76ab9b7e0f5967120c4b48692
MD5 fc4e82de45d7fc43c7a22fd2220c30cc
SHA1 bfd9052d0ee305b4db204bb6f1175292007b78bd
SHA512 0b3abf21aa9a8990ae25b8f2ee8cd1e70a30e45c59411e1d5bd5875fb082226a1f8b830eeb48bd92010c9e1ca825b076cf62af46dea7222cb6887a4c3275a06a
SSDEEP 12288:ryPz5L80yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:Gzy1CaEzwAyujOhcid/RrmpF
TLSH
T125850117B79631F9E12693358CA21611F7B23C3217248B9F63A8627A1E377D09D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 c74a5b5b0d8f83581f7c627e5492b571ee9a9e19dcff795ca619291022f30adf
MD5 a01f089b63d3bab564b0303901277486
SHA1 d2140974bc800ed04dadde7a5d0e1f5ed979b56a
SHA512 618038df8abc6aea396d91c2b3c49c1d71d5769ca81e76dceb93d009661318e94facd5ac8da5c247c5629c66cdd64c18b4c1d43ec82edb414a15cb15b9885f8d
SSDEEP 12288:yjyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:yeCaEzwAyujOhcid/RrmpF
TLSH
T126752337EF8A87B2EA4567331CB61068DB593C97769B8A8FB65DF12D44BC7C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 beb3c00e26a32a63a0ac8ac6d740df881a1ee75d202bb5ca591441412022d6c8
MD5 6a0323f304bdbcc824e15773791996eb
SHA1 4f7777dc13eab615a043e716dc96c7f5e0c8a6ab
SHA512 45bf988d25df5766f52e3092ab6c9f88cb2d6447ab1232828fb062dfb20e1188bb742b09f5e11a3130c6bdfc28df4e6b0a2e73af14a49ad1c3183ac07a2a1ac5
SSDEEP 12288:YjyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:YeCaEzwAyujOhcid/RrmpF
TLSH
T141752337EF8A87F2EA0567331CB61068DB593C97769A8A8FB65DF12D44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 01fefd60aa29332a2e047ed16dd156d6479d99a9d041032469444b00e3ea9dba
MD5 cf990cdff20949d845950c732296dd17
SHA1 791fbd5668e07c8da55cd635b82251bca37b3f94
SHA512 48938f430926bf302dcd328c501c531fb96972309e5cf0ef5c3038238f35c0b34ce059c067972c64bd1bd6b14f0a2399344556aabb083d5f0f97a9417f9dd4b6
SSDEEP 12288:WyPz5L80yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:rzy1CaEzwAyujOhcid/RrmpF
TLSH
T1FF850117B79631F9E12693358CA21601F7B23C3217248B9F63A8627A1E377D09D3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 621ac9ba941752bc82a5a28c00e58099b0ef0cb61d7ffbc55e2e17155a9ffc15
MD5 eae2b2b9ff393c9b8e11a1202a49c4cc
SHA1 6a6b61e39204198b417ed091bb558e1f514e1933
SHA512 c04773c4e7b1a917473f6664617df67ccaa6a800f81c0f77f8be2d75cdf8c85b6942fc297aba31b419c9bb4a917828ba684abae102eb02a819eabb0207b7bb05
SSDEEP 24576:4TnaLl3z0zDXCaEzwAyujOhcid/RrmpF:4TaLlj0CaEucW/Rrmp
TLSH
T11A8501A5B39058F8EC67823ECC664915D6B23C5A0770CA5F13B8366B5F373A01C2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 fe3727342e5030a1c7708c92fd0b112d917d78e4c207f0a7b9a9828b0ba8f300
MD5 0ba7258094cdf91e49b6eae172deb454
SHA1 92e9c5ae56da17523db7c328cb6b9e251c93f59c
SHA512 9a4b506aafe2b59ca29e432a2951dc81dbd3148e06045aaa0602ef07923f6354a3994cb0871cd542cc691331e0914a11ce1193ecb4b6af4c9808d54a816a049b
SSDEEP 24576:r3sd9CHKy7GZrCaEzwAyujOhcid/RrmpF:Lsd9CHKyatCaEucW/Rrmp
TLSH
T15C95CF90F3E411E4F0B79A358D764511DAB67C9A1B31CE8F13A8661A1E33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 5badeb8aafab33e5c22f062fc3d5f0663e597d37008b6208d0bd7b5155a40eb7
MD5 c5d7628c9ba33bed332bb9aaee7ea83c
SHA1 c0b956d2afbeec32d7d96249169c6455b3aafabe
SHA512 43be4f9b84ab41d6a56ab96395ca04ba16c1d1e15f2ed053f929a9e2700d55090f36575c10f4c6fed5a928b6bdee0ca4f9b7fa5ad87c93a383244004aa6f9301
SSDEEP 12288:EiyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:EnCaEzwAyujOhcid/RrmpF
TLSH
T194752337DFCA87F2EA0567331CB61068DB953C9776AA8A8FB65DF12D44B8BD0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 66bc91f427399547c0b8c069d39b3581b05145b774507cc1dcdfd1e59afeb292
MD5 53924e400c56773abc66658fa6752a6f
SHA1 2acafbbd9dab385965a7c07a94f664bdf6e505aa
SHA512 1443a2b3485dddaf5347c5f82098f36af92bdba8cdaa4d474c6f4c028210ea1f447c226fb12d3524b2a0a0bd9ff45d046d369559d1eb9eafa19b56b29047bb14
SSDEEP 12288:JUyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:JVCaEzwAyujOhcid/RrmpF
TLSH
T16C752337DF8A87F2EA0967331CF61064EB553D9776AA8A8FB65DF12D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 4695ca4d66e7e5a7c86587be9f1e6e50124d7fd0b1d4b19611552d95078f25e9
MD5 49ce88b6525bcac78b5a0e0168032e6b
SHA1 6f267305ba76d52613f1533c59032558d8384409
SHA512 2c3b2ed59e7ea0c0b0aa2a8bc6dec917b9fac2aba49c57c14534c924e62822f9fb0aed30aa789a11a073fe9d200702c081c5b9ef9aa9d35a1f1ec66bc3d7a36a
SSDEEP 12288:U9yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:U8CaEzwAyujOhcid/RrmpF
TLSH
T1BC752337EFCA87B2EA4567331CB61068DB953C97769B8A8FB65DF12D44BCAC0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 168fd18834081d398c6d7e9762cd81d43ec6ff22470f96d6429858ccad088e01
MD5 c389361f2c3d6de60b8e4d220ac1f42f
SHA1 933e583419634d193a6c10e482e07214d1274a04
SHA512 24089435e9ab18ea665422481e68b75f7ba2d99bc5f2363f69b27fc9532ff197c279e3276b258e3ee6a9dcbbd8acaddc62883ccbed369347c9fd36e3589c21df
SSDEEP 12288:2jyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:2eCaEzwAyujOhcid/RrmpF
TLSH
T148752337EF8A87B2EA0567331CB61068DB993C97769BCA8FB65DF12D44BC6D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 a04c3f7505b83b5f8ee97e2618f68bf5a6a97d7356c43522a1a8a37ca2a655a4
MD5 e49187e4b2098037669d1154c1498d2f
SHA1 d18dfb06384cf32ba05e6d2e22aabecf0b1bbd0e
SHA512 8506db2b1d843266f9bc1ff4ea4a5613a66545b6ed2af8bd28a3288d6e376414df0d0c0e95e7a47a25a20e9e8ccfc08abfb8e89f89f8376b3838c5d7f4d7e4f6
SSDEEP 12288:FiyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:FnCaEzwAyujOhcid/RrmpF
TLSH
T12F752337EF8A87F2EA0567331CB61068DB953C9776AA8A8FB65DF12D44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 a31ed7ef9cdad39bc008608d133b3c3efc9c19c0cbe39c219a393d7b33ae53cc
MD5 1b66d71d5e136073a5d53c8c7de09a7e
SHA1 4d73a1e68f878dba49c9af644cbc2f6745a47043
SHA512 7206457882198f86621ce8009d2c783d9a9bd5d17615ce50cb40dafb8171094732434d47491ebc819b57c17c487b25667287324e2a4b4c40d6c1f4ea34123b19
SSDEEP 12288:zLyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:zGCaEzwAyujOhcid/RrmpF
TLSH
T128752337EE8A87F2EA0567331CF61064DB993D9776AB8A8FB65DF12D44B87C0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 1b76272b68e911b904652bd4aae6414d2b6223e5272957dc214f1169710c20a8
MD5 d2e92355302c60361dc476e4e740fd26
SHA1 9434fd37751f75e5960e13e2fb59d33a8e63da5b
SHA512 3c2f77cadae8207a374c8e13592beb87135200642223a250d88fbea676a80e9403d9bc76abbc231ff4499c2a01bd78707a6f1f156c4ebbb0b59ea992118cd63a
SSDEEP 12288:eJyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:eoCaEzwAyujOhcid/RrmpF
TLSH
T190752337EF8A87B2EA0567331CB61068EB953C97769B8A8FB65DF12D44BC7D0584D020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 4ea9ca93c1bd54e378a512e0047b267e760c38bc5c2fd4f53face605e7650bcd
MD5 4afccab40cbe54038fb4a7c51074907a
SHA1 bd532830f6e4e15f6599f4505f682ded074923f9
SHA512 6f260fa717b61040730fcec2eff4dced570360120dcd77d1249720160c8c86345b4b7fb5a032e492d810b2f284159ebcb7a3d101cc1b908c5ac80f26b54f6501
SSDEEP 24576:Zfwvok9RX6wkyAI6CaEzwAyujOhcid/RrmpF:fMnYI6CaEucW/Rrmp
TLSH
T1CAA5CF29EBDC44E5E1B7923C89B3460AF6B178591B31C6CF129A53AD0E37ED05D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e367d01e2d8040c32e1fad19d77487e396d0de55f93ec9aa5eb014388bc72781
MD5 9e0e96174b1a33ac0c9efcf8c9c00b06
SHA1 8c0f9ddceb59b8741576e3b827d2e36630184603
SHA512 70681e56bdb516fe2cfa952c516979295a6e8924629ad3866e5350f003f3acc6f10b2d9257b35562be8e408f72e456c6a605c3a2df8a548be92988333c263d73
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zCaEucW/Rrmp:1ySzPWnudRSp
TLSH
T1E2066C56A1A841D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2e86b74d468f38c8902890cf35457e5b6ae4981b116c5d70474954194ceb5cc6
MD5 9c3222740cf963bad2a52d8a1de5a0ee
SHA1 24991056af387b2634198b2aad63df3072cf7880
SHA512 54f30ebbfa500fd94603d8349746cce9d3067ca1c78f846d3742cf3bb479245e816c13129ae378deaff00c7be025a1cb512c0fe417cded03f4d1321ab6e41d87
SSDEEP 24576:P47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpCaEzwAyujOhcid/RrmpF:P47JUQj1irIhCnDHUPfF/jCaEucW/Rrq
TLSH
T1EC65AE1EA3EC01E5E1BA92388515465AEA71782E1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3f2fdd43aa726472dfc129295551c31a4113618035ac3ea338ab5fb7a5d1474a
MD5 79b4d4916893e4076aec9c2a3dd352ed
SHA1 e083cd22bb44bcaf0f285f3edbd6949c1536a248
SHA512 0dc253858c4871074b31f3951d0192489bcf23944911fa8491b177f9ea9575e408acaf8c5315d11de85bba33b3e670a308eb1aac4760023e04e92253397bd233
SSDEEP 12288:C4sfTyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu2:QuCaEzwAyujOhcid/RrmpF
TLSH
T1A485F11AD68842E8D06E6236CB964640F7733C6693E1C3CB62D4F53E0F796D09DEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 002d0a909c7ecc4ff0983d9d3a1c1a157d43b699aa4781c23386f48c56d3c790
MD5 0f76055a93cc921ec2ca7202502410b0
SHA1 f7d3b328d045c561db7df6564b9f032ad86d4a69
SHA512 3eb8e4dd4689484b82de8c665beb2441edc6ac87c8c4429b4a1da31814a79594a3c8b0bdbdb690603d365e80938039e6c5386040c833b10731ba2d1a94d2e8ed
SSDEEP 12288:Haoz2U3f2adcXLtTAxcJ15jKRueO8kO0xESzr:HaoaUP2cmLD1NKRueJh0xE
TLSH
T165252850762AD75FC6AD40321E33D5CCAB707D01FE45AB0772C8872FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 bb1588027472719c82fe7743b4de179ea792590b197ade0eaef4dcbf5cbc28b7
MD5 c77c1f713d56c26747f4a54ab8ca7eca
SHA1 f97350f6c3fdfb035ac75dd11df37cd7dee0985f
SHA512 bc8d1b0c9c8c7230b267a426f749920a0e256d1eb4c46042e7f73a08a46fa9210f9c745a48332ea50831efbc59b045249b5a6cb96097f03f12835d0e655c0e04
SSDEEP 12288:xLNrws7oS+7+Xbz6GZ/hdnHzs2BQ0ekzAqwOc0:xLNrws7oS+7Qbz6GZ/hdnHzs2BQ0eq9
TLSH
T10D55B581913BA3CFD1F72031076A5F4DB764EC06B2496F6673C8053AD86AB25A0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 4e55a9c899744833023e1d6455c7efba60b4d7f370d1a9d62d1d2319a1bda1ac
MD5 6f24c9551302a46cb34c66512f01cd35
SHA1 a86e054e43bcb51a7909af6aab823977ec82eff3
SHA512 baa0e221d58287301bbd481ed5eed522ac73fda87f2216beac7a7ce688d7b74529acf35a4cd0b4cfec9802dc776225f98e8dd5dd8fc123a671390dad0ac2c358
SSDEEP 12288:eG77yCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:NWCaEzwAyujOhcid/RrmpF
TLSH
T141752333DF8D8BB2F96A67321CBA0034E71A3C965B59C6CBF51DB25D4478AC08C79225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 885cc8ecf0f44a78ca70c21324f729bcdc6a3ecf355e687c4e426055666a09fb
MD5 53541bc0a3d0a25c80113737837f3533
SHA1 c35c1ecb0e90de54c6968cb880be6ca9adea4995
SHA512 5a09fe1b4e290c8200805b265959d35a56efbd8025558fa361f3c24843af2cc3a12ed6d064201d42fdad871c717df319a7917dded85e71363c12f53ee01b3296
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bY0CaEzwAyujOhcid/RrmpF:/gb4mBIBhGFpCaEucW/Rrmp
TLSH
T1C165AE1E22EC02F5E0FAE2B89DAA4417D6B278161731D2DF1151423D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 780cee3c99c48998e609ca216c4971bedfaac18f80c0dae8bd444db7212ed5db
MD5 6dc543b49eda6a78788f2bb86ddf1d3b
SHA1 ae43606bb0e022cace49060fa3e1fb8494a66ba8
SHA512 da798d0c7aaf9d9e93e63460f6cf71a7ccd60ba7be0abdaf22d911ba20dbde73be6f7fdaa65a43685f19ff81c9f4110518f9d4060231319cdb1e10febdf9a860
SSDEEP 24576:LG88u8FpJqH10zria7/m5CaEzwAyujOhcid/RrmpF:K7ZFPqVDa7/cCaEucW/Rrmp
TLSH
T1BEA5F165A7E102F0D47BD23889924663F6B278251364EFDF07AC8A551F33AD04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ab2602664694efdc841ec05809b4e8302d956cfb49838c01b027a2227b6cc2d8
MD5 73d20ac31c8f27f0338c56156fdbcd28
SHA1 233bd84636c8ac72b36064da7a784f9fb8320156
SHA512 e1795942600e663a674762b8ff043b1966c8d342676f254d343ba9c4145ba8a8acf75080eecc5bccd0951e0da4c4534795bdcacb0c0d1110de7dc75da24a25ae
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9CaEucW/Rrmp:XG05lO43bxnudRSp
TLSH
T1A4D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F27FF0997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 00d15f3def49adef1d35e97478e876fec03df5d0de5c4fb088ee653b9f59815c
MD5 abf7ea9060bc16c70a5a3bb7902a29f6
SHA1 d572d2ecfa9e61e019f1a420cc7bb47a94fe5056
SHA512 a7ebbb65b427242c0f795ad16e7b0728dbdcd2a3cf226daefa148f4c6f723dfed3ae9ee0d50e4e30c66c3c89694bd92b0b8ed94969caa4fda7f63cbabe7fcc2e
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnzCaEzwAyujOhcid/RrmpF:fa5POZ3+Jt2pasx2+mVCaEucW/Rrmp
TLSH
T10565BF5EA7EC01D5D5B9D17DC583461AE5B1342213329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ca768b717e9023b63fda963d1f3e756d82adfa521beed4235982f3b8aeae42ca
MD5 f6f875d11b11097b34823b9c5ae897aa
SHA1 ab08cff5192f0fc9a5fcc95495f34f0b9c6f9da0
SHA512 9d363abac7e76fe9fffdee318f4135f7210ab744133a6b1a93809dca7577eb6ba5ce27b316b3b4c99717a76bf319a0189fb15b20cf3ec80a7eabb929b0b6644a
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkRCaEzwAyujOhcid/RrmpF:gNc/zEOVHF8CaEucW/Rrmp
TLSH
T176857B2623E901E4E5BBE1BE89779546FA71786513348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 77363f156f3e0d2243fe42a9fd4798c38461f0b95b8bd6d0e51092336c82a8c2
MD5 a37fe39a079ba62e570063968a176963
SHA1 fe9764c4176b2e25e3ee1e688b67f2d8c5f85f8e
SHA512 da636bb62174fe74d89a9442349ced032082d8af313af2974022b733f34b822a9fc6830d697e3487411653a9820f18bcaadf28b79593707b92f48ad48af49be4
SSDEEP 24576:c8kNvNnaFeYhJNtmZBmICaEzwAyujOhcid/RrmpF:c8MwBtOmICaEucW/Rrmp
TLSH
T1A055AF2EBAF846E4D1FEC6758D238112EA727861173293CB5290C13F0E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 84cbaf4792b81e46ffa7ab57320e294e79c994d589cd3fa9ea7cbfd2d5e1d06d
MD5 1738adf440fbb8213d1e23f297eb5e86
SHA1 7d45077b1ffd4e8ff0d4e4cdd7e332f2030b24b3
SHA512 7c65881691095310c058bc9b7972b1fd25d6c5f489460db782e23c464f157ca73af4517c693e66cbaacc6b4127a2a0fddc35e20888bed91107ec5e963d75d690
SSDEEP 12288:gHvUrBFrEjwaQsyCJIzF2zwAy10JjnOhiD4msiXM4JuR7cMm53FtrpMFu:gPUr+NQtCaEzwAyujOhcid/RrmpF
TLSH
T19B85E12F66DD18E5E676A23D89824219F77278621312D2CF02E4917E4E77ED4BC3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 002b598e42da14dbea7bc727b456e7f4ae9a0c36d05a6b56368db37226f43e7f
MD5 ec2d1beaef38c8eae7f4bc0acf12f6ed
SHA1 349d7346e25ee2830810b3db5904289fefb13051
SHA512 d6eef94466efc4d408fed47583794fc9c439355c4087dacaba0bebd2e3aaabf6c4193be46097db3235590f6be86136f6379bd6f8e50216634bb84cc83917d074
SSDEEP 24576:9D3FHshBIYQgAyCaEzwAyujOhcid/RrmpF:9DVHeBIAAyCaEucW/Rrmp
TLSH
T17F95E13EEB9C04E4E57BD27C8A634506E77138A9032256CB1294D1BA1F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1608-117-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1608-123-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1608-326-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1608-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1900-71-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1900-255-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/1900-70-0x0000000140000000-0x00000001401C4000-memory.dmp

Download

memory/1900-77-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2712-130-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2712-329-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/2712-136-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2712-129-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/2828-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2828-330-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2828-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2828-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2836-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2836-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2836-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2836-156-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3360-294-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3360-89-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3360-83-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/3360-81-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3468-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3468-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3468-21-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3468-22-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3468-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3572-28-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3572-53-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3572-49-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3572-51-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/3604-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3604-68-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3604-55-0x0000000140000000-0x00000001401CA000-memory.dmp

Download

memory/3604-66-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3604-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4272-150-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4272-147-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4272-141-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4272-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4272-154-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4428-111-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4428-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-105-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4428-343-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-341-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5000-1-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5000-9-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5000-30-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5000-25-0x0000000001F50000-0x0000000001FB0000-memory.dmp

Download

memory/5000-0-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/6080-93-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/6080-310-0x0000000000400000-0x000000000058C000-memory.dmp

Download

memory/6080-99-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/6080-94-0x00000000006B0000-0x0000000000716000-memory.dmp

Download