75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
Size 933KB
Sample260826-k2swtasycy
SHA256 75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6
MD5 25c6390c9df899717b2df9a796825eb3
SHA1 39b8f33496412d1330e918b7253f5203c49d8f01
SHA512 46e14cd3b4bdaad90501767cef0b5dc1f1cdb1f23b1501607547da747139a436f68f9298a2685afa2316d460c604a770d5777fbc57ecf9b75ff008fa3c54d473
SSDEEP 24576:vhHo938IvwoUQ8qrgohJ/rciJljHQeHr:vhHo935vj8qr1Jzvwo
TLSH
T14515BF0163E905A8F9F7A6389AF29121EA777C915B38C69F0364415A1FB3F90CD35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2132	elevation_service.exe
2180	elevation_service.exe
4304	maintenanceservice.exe
3300	OSE.EXE
3824	PerceptionSimulationService.exe
4808	perfhost.exe
1396	ReFsDedupSvc.exe
5232	SensorDataService.exe
4384	ssh-agent.exe
6000	AgentService.exe
1068	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f5a01e718f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000006842f12e3a35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057d85c2e3a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082c10e703a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e70c3e2e3a35dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d365e66f3a35dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2132	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe
2180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1824	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
Token: SeTakeOwnershipPrivilege	2132	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	6000	AgentService.exe
Token: 33	1068	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1068	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1068	SearchIndexer.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1396	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2132	elevation_service.exe
Token: SeDebugPrivilege	2180	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 5908	1824	75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe	91
PID 1068 wrote to memory of 1528	1068	SearchIndexer.exe	103
PID 1068 wrote to memory of 856	1068	SearchIndexer.exe	104
PID 1068 wrote to memory of 1392	1068	SearchIndexer.exe	105
PID 1068 wrote to memory of 4356	1068	SearchIndexer.exe	106
PID 1068 wrote to memory of 2696	1068	SearchIndexer.exe	108
PID 1068 wrote to memory of 6052	1068	SearchIndexer.exe	109
PID 1068 wrote to memory of 2000	1068	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
"C:\Users\Admin\AppData\Local\Temp\75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe
  "C:\Users\Admin\AppData\Local\Temp\75a35efd8c03ecec888b9cd21c6d1f7431a8a5aa91895a6b523beaa98049d7f6.exe" uninstall
  2⤵
  PID:5908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4304

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3300

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1396

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5232

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a21225be23e61c1e19437aa393094fb52426c40c7a1ccddf3e583b53ed6f9020
MD5 a7c59cfc7bcbcc26181a4afaa85341d9
SHA1 c7f62bfdda9936cea2fbd6fbd04b83c7c4c66111
SHA512 d554eb206678f94f8e58fed350b1951e9b960b50b9382c0c87dc4e1512f8cb6ecf59dd105e34ff33d61a78a7ea06cd5bfd9a8ee94e1e55d47d2fe91c3c445e35
SSDEEP 49152:Nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnrvj8qr1JzvwN:T3q6HjBk8qRJTwN
TLSH
T150D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 3a5a75d9aa1f2ee6470647382e30b9f190c9ca2cae5330a64ef7b7f5cd2c208b
MD5 0142919191794650efbe173d88ce65ae
SHA1 e0fff7efdbfa9efb7fe12b96e542b1e9b494b5fe
SHA512 3651ac80010e001a75c7aaf617e187447f8754877ce833e6f39cfa28e69bcdafb5f07790d2ce1c40f43161ef045dfa04b4df84ef55aca3ec9086a838a9e391bb
SSDEEP 24576:0XYfDtczAWvwoUQ8qrgohJ/rciJljHQeHu:ztc5vj8qr1JzvwZ
TLSH
T1FE05F128A7E408F9ED67827CCDA2C411E6737C504760E79B03B499665F332E85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 115136f021023ffec582b9c7a53a03bff15e3d173923fb418ce042e0af8e6cd7
MD5 04a01afe18fc7819ef70a30ae6508e03
SHA1 3581b2d112679c5be9860e4e4a346037cd6bbd43
SHA512 2332c0d7f6fdfc62c67e99320d854493a364ed0ff42aa419162a5b5bc86ef5180181431e2c79bb61b0f8275f1d7b181a2ceaec7591cc6ace65fbdb3816ab3f21
SSDEEP 24576:r0Le5ji0hmxirMTvwoUQ8qrgohJ/rciJljHQeH6:rPji0AcYvj8qr1JzvwZ
TLSH
T14D35AE16F6788731D073C0B9C5D2A69EE97130811B308ACB4296D77C7F676E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 727d49ef4f2f78bf7bf6075a6098067c092c9a166f45ca9ba3585960d05f6b9b
MD5 2e8cfb1e1016f9a9a6aea65efee083b0
SHA1 f8177666e06ea2a29e1c44a629f29a4f8c63b571
SHA512 d71e8dc7ffb00d20e79b0e702b1d845d3b6e933d0e21ebb1eafc8e1f1be8b22f4e46929214553ce94f3df7066f9d85a1089c55b877dd247d9dc53b863ce30e1c
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyupvwoUQ8qrgohJ/rciJljHQeHa:c/ezSC6vUzPvxHjyUvj8qr1Jzvwl
TLSH
T126756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 37089447171d46ee6ca16d8a4e9e15536411a8399b74e253ee4d29129802e2be
MD5 dd49b7530e2345883c58b9e5d2c50ffd
SHA1 7e4f2821e0eb77c78836f10f24348ad16e8c23d9
SHA512 7c8ea9597e645d3ed5b3403202ce25c5b740c3ed1aab1bcfb4a951cfb0f85aaa6120c549883c251d46e52b58310c653694d70b2b2278bd8898a8caa42620ff12
SSDEEP 24576:nVbqPb88hv/l+6avwoUQ8qrgohJ/rciJljHQeH9:nVO88hXl+vvj8qr1Jzvw+
TLSH
T1F0559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 4486a1d6ca8c9b55d0194c20fab0534828c7d96adbaa2df307677428a93a6be3
MD5 45070d04cc30dfb2ad1bdc5deedca3df
SHA1 14530967eef1ff14b0666f249d0d1c73fe0d0029
SHA512 1c35d1f0bd83fe1bab8da5c5140e957224d893a4dc2220ad826ad7633d1a22d3143148724a065b45a0ecbe0aab027ce8e7739767b328195a4aa3289c7a9543a5
SSDEEP 12288:/RHi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9I:/RHvwoUQ8qrgohJ/rciJljHQeHI
TLSH
T114C423848D7C1DA1FFEB8634BBC2E0B475C9BCB068A65A374371BADA99311B1DD05231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 4a4d71ee27e06cb252b6ed055ddd8e6910a1dfa826df263ffa1f4b038d26c413
MD5 71d77a7c303f1af2aa86d590db799cd6
SHA1 5952b24425c5d73ed757bd7036a1eee5574ff787
SHA512 785a5a932a6e1faa404d367bc71d2cb8c9bb8e921b5a3c63fd0fd05ddc72e5ef82109db29db3ef499c4d694af38204d3515e8cf65073efb93acfe088fbbbc63c
SSDEEP 12288:6eBNUbTVO86Uii8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9c:6JIUivwoUQ8qrgohJ/rciJljHQeHc
TLSH
T1F205CF3BEE38FCD2C67A8D785B91C200E7A278704B6293CBD175824EDE235E15E75825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6308b0ad87b80dc09226f4971be0b6d5b5b5280a7ef62b24963144a79fc02292
MD5 2cee363138bfc4625d473b06c545fc9a
SHA1 93836c722096b3ac903dca7b5a227ade40419450
SHA512 5df8587263377cefc0a0a41d94dec30a58feac7ee45746c8b662c726c97ccc4e789d4814e0c57caec0bfa8e2f6bfcd500ceb3bccd86d8abeef79c26c1812c4e1
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:tQvGAdlCEL8c/yRNw5Cp8qRJTwo
TLSH
T1CF267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 967fba696a3ca2bfdd55b120b175fc2f29df35128163b6c5b61173264f355359
MD5 f73e6027e563e261c1954e8f298c94f6
SHA1 650818b1121bacfd091788775784a5ebff5ac73e
SHA512 25c470abf75c44d1ad6337cbee5069c756300d5a3949b137bd279ef40b22a560b29f2b0e0a26e56accb31160286d758b5672bc9707c9579e415c99f5c4e6b218
SSDEEP 24576:zdewsAjIvwoUQ8qrgohJ/rciJljHQeHJ:RljIvj8qr1JzvwG
TLSH
T1A015E031FE74E432C7BF0DB62B62D316146C79604B611AC3E3B89E9E59301D22776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 30669d530f91a84aedf17c2db1f910ad920d93015fc85cc603e49fb24c7aa377
MD5 2d1d191567d5dff6285ac8807485d028
SHA1 1695033ad76522ab4e637e3fc022765a54f4b5d5
SHA512 87fcce5f22516b7bc77580b43c1047e07efe345b770e5366de3352f230a41f50597abea00d7313a5c1fcebdd1d6905d16199d74c4437d5f1955676ca77eb2aff
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHsf:uUEtQevvqc2W1cpV2EI32s
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ca0005aa664da7d22d197a327242db9a9ffa0015dfb21185cabea1083ce3ed62
MD5 a1ad91de4b417db8cc959133d46b9031
SHA1 daee872a6d04ff136815ef9b5e6774cc98f7311a
SHA512 908d892bef2e2015309e11e156a61b580cb3b41d54a0d1bada91c50ad594dd63c1b5d6c51861810098356f7917ae0866f8897afad302f26c766f21d1e7636210
SSDEEP 49152:CCbRquA/m2yL5zifFiV+XenmE3/zovj8qr1Jzvw7:HoqHVjnm98qRJTw7
TLSH
T171D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 18361897c7c0e0f6890d2a0a36e37c04543a2cdb5dc357108106e059dcc3fcf3
MD5 c6a731f5b2e42e0f7a5f20a1f0644ac9
SHA1 77976ba7f3bdccd5e8366a7e844b633a2ebfadd6
SHA512 e1bc7c1e57f80d9cdd7ca1325349f014ef2f6085e28767937b4488b86c69ea48b0f3a4170d7acd392a18399001a4ea557c2e9f023fc8c149c7c2b28245b89b96
SSDEEP 24576:PAhGLJIFoiwtA5l7S531vwoUQ8qrgohJ/rciJljHQeH/:PAMyFoiq5Fvj8qr1Jzvws
TLSH
T173359D80EBF955D4F5F39A78A9B69070EAB6BCA55E31C21F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b6c16a374afee215f264a7fc5ae3ed915a789787a0736f12e688d9d71bda2509
MD5 f0511cf2caa4e3840013b76c4b52b417
SHA1 be4567a6a5b4ec7a2c7f4e652a2024a131676802
SHA512 636059a3aac44b34fed88a0ae51ff2b38c132e1f6c5d62e0772ab605e6a3d634d6527e03865de254614d103ea0cd69f763cbcd5fe9e9dfd3f5e30beab9f9e2cc
SSDEEP 12288:Nmw5HEjsChNVBFgl0WDm+CJi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHu:owuoOW0vwoUQ8qrgohJ/rciJljHQeHW
TLSH
T16305F14566A81CF9E9A78238CA87D035F7F2BC112A25DB2F1770C65B5F33261AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b9b044a774a0d17573ce5867005d479572ff774ef03ab47bbe58cab96030391d
MD5 6cb4758ea9f70fc2a4463b112851c5dd
SHA1 6439d942bda846cedfbcfd6fabfbff164cf86ca4
SHA512 38b25e2ad8ae75a448e8a92d4454bfb3caf037b444e5d74b578787c0e745bb5a6b203678fc255f7afd6949ef4d67126e89b681bdbd11e37b7001d9c017226659
SSDEEP 12288:PBZ1Iy4i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK97:ZZubvwoUQ8qrgohJ/rciJljHQeH7
TLSH
T149E4128926F824F5E6E7823CDED19054E7A27C60277243DF027166AA5F33AE15D39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9eb4a8ee7fbf63c553d36251a4a73fab5f99cbdb3fc09e759e6c1c1993ecdfb6
MD5 e4bbcc82364258c1e251ff55bbe396cb
SHA1 a8dc20f501bd4bf79fb179ff01c0449d80e09c65
SHA512 2f402616875cc525a0a1ec80bf254f5156dc6d4ca879e8c1999340eea5256b9c2e27484e53f5d049025404399ce2ba083460fa5f041d67fe255eebfabaab5c6a
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3A8qRJTwM:0QyiKayX+PNmf
TLSH
T134667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c470c506ac544c5e980a1d19e92b5fb6ff8c756903652e0d4380c35dcb127bbc
MD5 761089f4636073e18ea5a278cc4e47cd
SHA1 cd91e4d707454ed4514ff695bedd719c19974883
SHA512 b197a9ea2e6d6287eb03a1bb71d7726c8559b1868d32332c2d9955b485e68a8deda4d75f54fc05695b173ceeb9b15d4293b26efe1b508dc25eeee320509f5dc4
SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3A8qRJTwg:5QyiKayX+PNmf
TLSH
T175667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8a1b1434d93e05951a9c03146e6c17c46ba89805f845d0e8bc53845265e1e9cb
MD5 564f1bc934057d6ae816ba5509c8fabc
SHA1 c356e187dd60782ac27c07b3e8f38ffd8d21b6fd
SHA512 23a412dddf176d4c0424b016c63547e64ddab136dd0ebf76e654cd20283d4827082fff5579b4d5b84c967e0a0ec684d4f0b764c555875026c151d9a9e333b916
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0rvwoUQ8qrgohJ/V:r68Qg55nhheWu7PNU3/Yvj8qr1Jzvw0
TLSH
T174B55933B2F600A9C44DE1769F46973196D27C718FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e3813408a7c7dc071627357232a52c168e8156e2c4e819d0bf4263626144cae3
MD5 49282a6aaabb51c7e3ac18238becd32d
SHA1 a053fb58b3102ab5d93bcbc9a8417370b0a683fb
SHA512 d2a116fb64939ab48e869266e8073c57f089b2cd9da3b0355d0f4d61cf0c77328badd4fc454868b065680288253a7213fe0b9d71a37f7de2160b4cc182e7482c
SSDEEP 98304:py5112gYy5azzVvL69nLKnhZr8qRJTw0:ELIHmWhlf
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8936c7f835dfd4d7231d1328c95ea12bd9818cf1c36e73f1e4ac18e19d3d309
MD5 be984a8fa34dca3404af2ab4d5bd8473
SHA1 0cb8cd236ac0e4c8394bc7d7f9947dc059669d19
SHA512 8b3e6f7bdcdbb77b49ea59a455550a3cc75eb8abdbb674f1535dc8680aa55d6b3a92435f2975b5c9903663c52b87386a1aedf2ad5bc3f72f9511b67a7a8a7c05
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glDvj8qr1Jzvwo:nu6JmVxd2dP8qRJTwo
TLSH
T134D59D13F1DA01E8D06ED478974A9232F962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8fa8f7b51031f5374f94a3d3eeabf4bf1302669dd5492d67e0568bdbaf6da931
MD5 e8d76d9f7e57d799a90bd116be3dbcef
SHA1 10b865fd685e67284cef3515b773986138c98736
SHA512 6f5ae1ea685cdcf06f73400563ed9fb8af556eb7010b96fec9f757450fc3aa9d333115867b631436a9836deb372a3cf6379ca0d7106aea4425bebfc492d029cc
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xCvj8qr1Jzvwd:QmifPbR98qRJTwd
TLSH
T1B9B5BE13F2D901E8D06EC17887569232EA62BC450B35B6DF0A90B7961F7BAE45F3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 234e3a98c5cb590707fee339c80c0749b762bf9db8b0e6a8b9a0a718f426006b
MD5 988c6499648d45249bba92265887680c
SHA1 cfe96839dec9a88847774b0f562de84a11d607d8
SHA512 5058eb63ac45a4add28a3799a236eaaf2f29b0037c93c649fb29d984d92290c5f6d07bfdd0d20dfe3127b5356cf276ebab3b643cd7c2d3121765e250e359b409
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqbvj8qr1JzvwW:q5dKTi6138qRJTwW
TLSH
T157C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 af6ea610c7dd2a1a4e1e7e18e00062271ebe17d3d3152ca95f04ccc95063407b
MD5 662b8e94fca0055c26d23060df22586c
SHA1 dd7dae43cb667b066af2e593ecbd63d4e9203ee2
SHA512 9d5a6863ed93e60ced1817c7256f8941cc6ebf8b7b6e7929369a1967cacffabc6d516d4520af97c55bfdcb7d5468e99c701f912b868b66dc5a32a95e6f2f11ce
SSDEEP 49152:BhtSn8EApI0figngiDn0AP5wWvj8qr1Jzvwt:QX2iyphR8qRJTwt
TLSH
T10095BE13F2D901E8D05ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 38c82ca8795e1212e6e3797508ac7cb19f12c8357b3918889365430ba1e77ab7
MD5 a3f9b934a601208ccf937590c1b0c3c8
SHA1 0f74befc9c5fd85f21a2ecfd73ffd60600a945fb
SHA512 7e33d5cb3424550262b470b1a5e461d85c5da59f5266220c5240e40b124b564980ba7f23573e05fce676a162237250cc758894cfe5545acedaef75e420daf211
SSDEEP 12288:Avi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9C:AvvwoUQ8qrgohJ/rciJljHQeHC
TLSH
T11EC42384CCBD0DA6FEDAC274BFC2E0A4B4CC7CB078A6167B5376B5969A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 ea1294dc425058ba82f0a702ef8d94581d35635370f67da226972913bb33bd26
MD5 3314654477c1e982c046fa2409f34074
SHA1 f7632d6ebbe23a6155008f5295c564a7707b1cde
SHA512 6a559325ccb030ec683651f27f2e0acea1a1ac993b2bed75444fa1209a7efed43102ac4e1f456b3e2afa01bba73062358803d5ecf006302e4003694beefecc8f
SSDEEP 12288:kMi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK93:kMvwoUQ8qrgohJ/rciJljHQeH3
TLSH
T16FC423848CBD0DA6FE9AC274BFC2E0A4B4CC7CB078A6177B5376B5969A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8b78fc889eb2ac9b615b3adf67e0514a3edc8a080da402212edd2d2c019d7ba0
MD5 0b78459eaca14a33c825e1f372a39459
SHA1 1e77f9771440cc4cbecc52964f5fe83b8d4891e6
SHA512 39c702b82c0598a6a92ec178f8acf790a62990aa4e197dfa8be1823d511456f0020d52937aa2e0c573d421026845131a2da0c0339a6466dd066bc06809fc62a3
SSDEEP 12288:1qi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK93:1qvwoUQ8qrgohJ/rciJljHQeH3
TLSH
T199C423848C7D0DA6FEDAC274BBC2E0A4B4CC7CB078A6167B5376B59A9A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 6c8802c60f8b382856a91a02abf4468127e9e42a70770461f7170baf17847817
MD5 d102a75d1dfbefb584720832c6f0dd53
SHA1 52b748a99fe1d16d38ee120f266f4de7b62e6070
SHA512 d801f2507726531fb38ef61e7cd800dfd3920146090d4149ed0292b812ffc5e1b7c4140291cc0df42ef31164079cc43adbb5f0a37cbf58a579780c94b3e28fff
SSDEEP 12288:ZVVi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9y:hvwoUQ8qrgohJ/rciJljHQeHy
TLSH
T1A0D4238489BD09E1EDA6C278EEC2E060F2E9BCB0757257BF5371759A4E322B05D25730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ca294146793a41bbcf87fa38e02878bf0eaaec29c86cbbc2a3af9cc8b95a21a4
MD5 1b7262d8e250481e754779e5d08d8b30
SHA1 d8ed8deee3c6e42d90ea917c5399515919e87098
SHA512 a9c2d0c5b8e7574373e0d1a12cc458a8be2c3fd7ef741b049c5d5e80b61b6bf59b3cf96936486e40cc097f878a6e948cdcdfa21f34024ef8784d4984d1436be3
SSDEEP 12288:Dti8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9b:DtvwoUQ8qrgohJ/rciJljHQeHb
TLSH
T125C42384CC7D0DA6FE9AC274BBC2E0B4B4CC7CB078A6167B5376B59A9A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 fb3c4c99fe4a3dcb777a71c4ebe4e996fa1e4022c81a0dd26048d2be81d21fec
MD5 37387f41f063d2c6f1f24d1c5c510a5a
SHA1 7a0123df0a2d0221edabb2d7b47cf0287ce95d96
SHA512 77dd9e868a5d13c0b3d96e1266005489c4d09722a56230584f22e003df913290d3d032a20db86f0040f45ceb5f2794a62a7cbb5a3bd15759e3969df70d81358d
SSDEEP 12288:6wi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9b:6wvwoUQ8qrgohJ/rciJljHQeHb
TLSH
T16FC423848CBD0DA6FE9AC274BFC2E0A4B4CC7CB078A6177B5376B5969A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 062e20639876c2ba1e8f52f3ad8bd9312f8bd1422ba7fe2c8b6aaae08606736a
MD5 4d2b26b7f81726c946d3bfba6b24f563
SHA1 0b04dff13227ec6d4e8d91e49e40b83f1825f3a3
SHA512 1817cf7abace54ca842d359ac88dcee4e25f9a19ec7465a59af68dc74ffe74a63dca4fa6a17fc50b26abcca98df8c04559e7c76f94a06fb138e291d63a3aa07b
SSDEEP 12288:BEi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9z:BEvwoUQ8qrgohJ/rciJljHQeHz
TLSH
T164C42384CC7D0DA6FE9AC274BBC2E0B4B4CC7CB078A6177B6376B59A96721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 fa2e711e714a5678f40aa24a3c787cf3c033af51355fc657a766b0d4ac9abee4
MD5 0c5c44f70ea87b72187ab69c69909cb9
SHA1 31941f133f8bf400f73438920ba6d86821e2b221
SHA512 34584adc43afebf5bd4224a8f53e2ae2ed6ef76761448776ddeea3913cb48b823de6e86349036bfcff927a5aeccc0ab8869065369552e592ba4b94e145699773
SSDEEP 24576:FZMSzFVSOsvwoUQ8qrgohJ/rciJljHQeHk:FZMSzfgvj8qr1JzvwD
TLSH
T1E005F194B3A41CF4ECA7823ECD529815E6B27C651A70C62F03B4366B5F333A11D2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 b3ca56bfb52162c81429b9553f841d120b9c72c76be068ae81baa57f09d15122
MD5 c25a84f1fbcccbac16ff26e9b74873a9
SHA1 a4346bb5b0f1d71668e4003e831834798a852e93
SHA512 c140ab2ff4e807f5064d8829d0dc3e9d25b1fbca1259a5d24c50b2b0e673e733307316285900207d790a96687a76091cda29011ac27a13d57eec93e9dbb07a8d
SSDEEP 12288:8Li8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9m:8LvwoUQ8qrgohJ/rciJljHQeHm
TLSH
T160C42384CC7D1DA5FE9AC274BBC2E0B4B4CC7CB078A6177B53B6B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 ee0fde659f597a3cf71f9d807df5b56763c674fb91f07d200701b44605c4f36f
MD5 e6124a87fe636d11d0523c23abce542e
SHA1 69adf928d0c39bf63ec0cdae6ecd173bd33bc236
SHA512 b9f2d139fb04c9f9417ac6f85995e31b5304cee5788b76107a8990ed3f91a45ce9d729dc9cd37b4337b117d762e91ea6958db7d02af8fb39c8d5b284f6694751
SSDEEP 12288:T3i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9o:T3vwoUQ8qrgohJ/rciJljHQeHo
TLSH
T123C423848C7D0DA6FE9AC274BFC2E0B4B5CC7CB078A6177B5376B59A96321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 756e2ac574d01d6b9498baa496eb73992d04ee46bac6fb2607013cf3f433a54d
MD5 a4e567f416072d90c34b948e68efe72f
SHA1 22f13bf3497b64727d06ca31d3c8a601f515d2a0
SHA512 1ca3eb15c716fad4f9e3ca3aacca1fca9de7a8a9572bb9d98194e1d61cfd06793062897138c31789b5fa02c005e38f690017beb2722b326f56dee72dc0c90dd9
SSDEEP 12288:oyPz5L84i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK92:pzy4vwoUQ8qrgohJ/rciJljHQeH2
TLSH
T1D3F4014766B520F9E5678238C9925511F3B5BC701B218BAF13B457BA2F332E09E3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 909d3f132a553c1fbf993240b611a04622eeb16dbe5f8e22577c0d253149172f
MD5 5351d0cca707bbdd41d31390b0ad7087
SHA1 fe140297cc8c7c7b19a157f1c2e8e6f490ac8096
SHA512 d90584c09dc8899d7a64c1c9fb93fcd62d02ae374ad5c2aab15b9a9daf0d273c67cbea4649095203772ea5c7e7c44bd61df666a3c1a4350f821a98782f724f7c
SSDEEP 12288:VLi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9k:VLvwoUQ8qrgohJ/rciJljHQeHk
TLSH
T1E4C42384CC7D1DA5FE9AC274BBC2E0B4B4CC7CB078A6177B53B6B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 ac8c7919cf82ea0a57d08aca9ce63c1662bdeeab2ebda2bdbf183e95728ef98a
MD5 89bb8be075bac87524700d6533d7fe7b
SHA1 5d650333fde9ff3c476461fe0d6ef2775416c14e
SHA512 10474dc491e81e1f42d0b76a32d8aa03bf94f980d10129f74cf2202d9fae9ed8d618c9e36cc68923d2c2456b055d494832722343eafb0f9cb0bdedfeeb7eaf0d
SSDEEP 12288:sLi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9k:sLvwoUQ8qrgohJ/rciJljHQeHk
TLSH
T151C42384CC7D1DA5FE9AC274BBC2E0B4B4CC7CB078A6177B5376B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 7cf7d6d106767ac2721b53600be5c1b9baa115d33a039b12ce7e4595f77a1d96
MD5 2980891945aaa3b045e93c323e5a82e5
SHA1 a98a28f9c2ee7142e299f73f9b904aa1d02a3277
SHA512 ff7e11bd2c46530f8b1b8e5e0304c08884818fb90ecac5001da318cb42abfcbf23a79c9761424c391bc280964efdea63ced2da79fe5268912d4f71141b6ee05a
SSDEEP 12288:1yPz5L84i8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9X:czy4vwoUQ8qrgohJ/rciJljHQeHX
TLSH
T1EFF4014766B520F9E5678238C9925511F3B5BC701B218BAF13B057BA2F332E19E3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 e7089de816e41974b180805ac6a809525ad2180c479211c213f517bfbaa84bb1
MD5 0bbdb907e542111c0ec455dd388b4f52
SHA1 548b97d8976f485e16fab62518ed0580b36e7a29
SHA512 0613c1a9a9872ca3b3510a2af1bb2fbe8a621a88879254a8818392e4540afc28d2abc15496f4aa1186c1f8acc1b2e8f8b22500cfcc1643ee3367c3335e2084e0
SSDEEP 24576:gTHaLl3z0zD6vwoUQ8qrgohJ/rciJljHQeH/:gT6Lljpvj8qr1JzvwQ
TLSH
T13205F194B3A01CF8EDA7823ECD529815D6B27C651A70C62F03B4366B5F333A11D2EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7d01782905941d46663228cf6d2b90a59ea2248b51cd120b8a61524107d363ba
MD5 3b0534b9dbc038594bf8a5b95babdda8
SHA1 00b7a4e33f128985b1b811724ecdf1948404672b
SHA512 45674483d13e7e11986df35e532e3a3511ae67bd14edb7ab3a8bb75f34f6f22b475807bf8cf52422d1a947ea2fdfe688e93c7d0a08f1d113529dbad9660534b3
SSDEEP 24576:T37d9CHKy7GZevwoUQ8qrgohJ/rciJljHQeH8:z7d9CHKyagvj8qr1JzvwH
TLSH
T1C025CF90F3E814E4F1B7CA358D629511DAB67C991B31CA8F03A4665A1F336E18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5c3d7167e4d0e6ca977868e9f6f479cc4820c4ae34d19588f6199b8239aad4df
MD5 6a82df3419cc0bf6e574b40612a763ab
SHA1 20b6a45d534653a6a5609c187d0807bca0f20328
SHA512 786bc8b2185f53c7174ffef23cfa7da0927a67680a3c1f2c44255dbe041f616b2ce388669536383f7873bb77cd0ddf34646e051b8bce3a663821d9de464397cc
SSDEEP 12288:wKi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK90:wKvwoUQ8qrgohJ/rciJljHQeH0
TLSH
T1EBC42384CC7D0DA6FEDAC274BBC2E0B4B4CC7CB078A6167B5376B59A9A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 e65f6101706741fb9c976b569703e5bf24ed7670d878b86b05beb67d713c8b6b
MD5 cccefc611f1553cea176063a8fa0fd39
SHA1 8e8624f7fd5a2730e458fde2817d39e70d673de4
SHA512 d5cf5214ddd2c45e1d3fc5f73d7c135a2a3ab979e450ffe2edcda228bd6884a151221afdcc576dba31215f7488fdbb90fc013456be8fc206fc6feaffed5145a6
SSDEEP 12288:5Yi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9j:5YvwoUQ8qrgohJ/rciJljHQeHj
TLSH
T1C4C423848C7D0DB6FE9AC274BBC2E0A4B5CC7CB078B6177B53B6B5969A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 948d21658490b6d68fe2bc751f73b7c98ad31a4f21e7d434bb589288b91ce8f9
MD5 3682c45d16727198205c00e59e3720a4
SHA1 68cbac95b24e665d37973e053fecdcbf3be57ae2
SHA512 ce4f39869f1c4cddc1e3e74abc8097cc67ce2e007c6e6a0f5804a870035c0e59bf981899de6f942afc57c9fef35cda153acfd5e7d3814aaa0710101ef83c9c42
SSDEEP 12288:BBi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK92:BBvwoUQ8qrgohJ/rciJljHQeH2
TLSH
T1D5C423848C7D0DA5FEDAC274BBC2E0B4B4CC7CB078A6177B53B6B59A9A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 ec31b774b31fee0c0f1e0153a2cc0c839611f55f80cd580331f5d7e33984e8a6
MD5 20e43b0859c5866e27b66aa29ce0c00e
SHA1 80600c8f46d6c539dd07fa35082c28ac68d10bd5
SHA512 ab51cf8bf0e1353f2ac2dead8fa0b7ed65421cbf9634c302f409aa51da1cbfcf32c07cbd79c30c8795c960d2d1d8130a85a77a3790497d4abbc918bc00fdacfd
SSDEEP 12288:4Li8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK92:4LvwoUQ8qrgohJ/rciJljHQeH2
TLSH
T18DC42384CC7D0DA5FE9AC274BBC2E0B4B5CC7CB078A6177B53B6B59A9A321B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 dd17d765e87fc431d9552e8beeb60b996f92d40d719f85505e354d9111d6ab5d
MD5 1c55a33b899d22a2084e86dce8416b2d
SHA1 71abe3ba82db2d91d329faa88803010e7bacb165
SHA512 4fafdae2978d66b1c504e460b8913cb1ab019ff34d89cdeaf76cd7c877e295c2547ae59f926e72e8d4abad1ee214bd0b6f79d3b37683ea075a36d5fb70c5ec76
SSDEEP 12288:hKi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9K:hKvwoUQ8qrgohJ/rciJljHQeHK
TLSH
T148C42384CC7D0DA6FE9AC274BBC2E0B4B4CC7CB078A6167B5376B59A9A721B15D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 41b0e02cddbad50d189918258f2357f366586ee202d86bb71f48a00e455f7ab5
MD5 433540bce90fda1834302dd7055c1908
SHA1 e43b2c093cbf397ae3a509c3803a26a39c55d628
SHA512 4be5a46cce91000fc997d2680c1750758ed8d7053c799960a66958aca992221e3993826076ae0000b0c54226eb52565b0b94348e41774ba4f8fc134bff72cd49
SSDEEP 12288:pji8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9w:pjvwoUQ8qrgohJ/rciJljHQeHw
TLSH
T190C423848C7D0DA5FE9AC274BBC2E0B4B4CC7CB078A7177B5376B69A9A321B55D05230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 7f9d0e5ad5f41bb6df221d783371604c9a662ecbaa4a66ff64fef2ba7459ebca
MD5 af5646bf7462a9ff6d9dd188b33fed87
SHA1 1a0e2679ec55601a7ff408e63ef16b43a1fa7541
SHA512 747553aed51a0f6186239ac0d7493586de01c249077b7c409fcccb56e4d8f29e31d01c5ab4aafbb59037c2b52ee0a33415e3bb40011daefbe3225e2aea9cb9a7
SSDEEP 24576:yfwvok9RX6wkyAInvwoUQ8qrgohJ/rciJljHQeHA:eMnYInvj8qr1JzvwD
TLSH
T14835C029EBDC04E5E1B7923C9DA3460AF6B178681B31C6CF125A53AD0E37EE45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a89d726d91ae51dbb2a06cd26962e4fac3b5325994e8fae090b10edf0fbd5f16
MD5 8a5ce1be4708978d1d4ddfd761e6a2a0
SHA1 6f7c6a382a68b59a34c1dea65d39c6d0bd2d36ca
SHA512 733a3cc97568605980679cff767d56d7a8e77d60eda8777c203367172ea8b22726f28c2b11813a87034d166e9a23fd7e98126a32f69bd80b830be09bb0892132
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02vj8qr1JzvwN:XySzPg8qRJTwN
TLSH
T18F066C96A16801D5C1B9C1B98F0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5a9a6245918fd26bce9ddf9ec3eaaafeada22c8c850f049dd20b9e918ea84516
MD5 925e3c3e3b882b426d0f03d85e36d473
SHA1 243380b2897a53550c69112cc02a17ea7a4c0986
SHA512 4e5a88de6d5384eacae943f2be81b83ff7b50cddc38b33a1ab1ed0448e464f2dd7162d784f5aa1ef2e7cd3d222d24557bb1e75047d65818b153ae78371e8658c
SSDEEP 24576:W47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcvwoUQ8qrgohJ/rciJljHQeHm:W47JUQj1irIhCnDHUPfF/mvj8qr1Jzvc
TLSH
T1E165AD1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 aebe9944c3bf23351c1d7f5e955b3e790de598cee4ca8a18a3424a2d731e7a3f
MD5 782f7cdd27a46f6a8c7843f40b8f0611
SHA1 1f16e390c60fb926b592eebb19addb5bd30dc636
SHA512 cb9d4af109a2ca6d1fafa1a5268f41d6b3af6cf4a6ed3d9f1c2a7fe62e04007b9fbe1958a35a113390c21736bb62a22ba60064541e0eb76cf91d32825e90176b
SSDEEP 12288:ENsfbi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9n:VbvwoUQ8qrgohJ/rciJljHQeHn
TLSH
T1EDE4F149C2A802E8D4AE9239DB829540B3677C6057F1D3DB53E0F57E1F362A05DEA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 988KB
SHA256 0608f246a59d0ab0af4440bceb0a9dbbb7a9131e9b32313d0a2911feb510d16d
MD5 0de326c879330a5b2e2ceeae2b599b45
SHA1 b2caa24f956f12f15b1c935ecfe01fe62e9b8b75
SHA512 cbf0d502bf0906fd7e711db8346782463cea80f0f4de8b060005f9b719eaae38e63a2249160d429582e5c55d82c67c7e3eceb7f820607ef7cec797496953bf12
SSDEEP 12288:2mYZ0WU3fJsb5oJSTSk4jtuJaf3VWHNXwhePJsd9Omwgkj:HYZ/UPKyOuVWHNAhePGdkm1
TLSH
T1A42508007666C74FC6AD40321E36D5CCABB07D51EE446F0773C88B3F9576A58BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 1bd32b25fd114c9fe46a43daa14bf60fd14e0bdeba4af5147ae852e87b4b5753
MD5 7b927fdbd9f4dce7098b6d814d2e19dd
SHA1 781a1dd2ef607de2d83b81767b507d9d3558a321
SHA512 6e3930b996b6189e67e20da04e8631f680f7d192fed17818128dea2bb0580dc245bbfeda328ba5eafce92426fd07ae77e61fdb8772d383c43db90423d1baecda
SSDEEP 6144:qc3EFiVYmD8rWznbyY4vtuJafjq/b6v+EWEajJMSqtMxVD3P96bBNhrSqtMxmyYd:q20sbyDtuJafjq/b6K/D3P96bBuTm
TLSH
T15265D840A437A38FD1BA6031072A9B4CB7A4DC0677496F27B7C8453AD86BB15A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5a01e718f8562d1.bin

Path C:\Users\Admin\AppData\Roaming\f5a01e718f8562d1.bin
Size 12KB
SHA256 14ae15cd5e02f870a528aee76506d4e919af0d4b81380252cca20e90a0a9cb28
MD5 cb781b4115a7152ae0cfd76260687101
SHA1 99bc1fed9e0994ba9b5ad3663f7be34b253dc69b
SHA512 0e529e5b307b9e18b539d4e8cd5e0f2bc15a2248ec3a6b2cb564c91e45d57f57a6369df99c1c2f8cb6e87305722318c0e016a201f9c4e4ebdcf978b2958c89d3
SSDEEP 192:RBXvCloxXgM3LYhF4N1hzlyRPeMPmo5SBU7FpWYhDmOzw/g2zzWD:n/CWf3LmFOhzlQPBFNLW0zmiD
TLSH
T1DF42D02095E1079D9A805F4F1B0CC0AA6D7F9267B84417BFAC9FB8398F50A0DB9705D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 86d8d7ced40d98697296ef23ffdaa0f062b9bb00ac0244d3f9b8d72b7623be2a
MD5 2a3cf8c532f5edbc14d1e40530452f27
SHA1 76f581a8e9bb377f4b01cb8f3e3ff168509143c8
SHA512 0b5f89e6b1c2f9f567c294597a13c790fb40cdfb55a6fd1f7c26afcc53ebb520a2da59c1b2c2ec3eafd13abf39c64f5f721fe6a6d654496bf7ee0da471b50459
SSDEEP 12288:1z7zi8zwoUwPZ836rgonhKg1tlrCeKi7p73PkSjQCQoHM0iK9u:tzvwoUQ8qrgohJ/rciJljHQeHu
TLSH
T15AD423808ABC1D61FDFAC2746AC2E030758DBCB02B6152F7A275B6DA9A315F19D35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7f5dc214ddaebd11cd922d080a9c896dd0031b29b2dfe98cdd5fdf99a753d454
MD5 0cc4b9ff2320ef3772d337525e235dea
SHA1 e9ce766cc9ab7dca6625c333f377a56c981197f9
SHA512 1d18e8dd60aac03f6c37f69013e7a748b984947fbcb54e906e7121158f4d2f4fdb530d79c91346b63ac7cbed5ad57d0a10579a719b8574b6281113e190290774
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYpvwoUQ8qrgohJ/rciJljHQeHH:jgb4mBIBhGFcvj8qr1Jzvw4
TLSH
T18865AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a37e56292097d11ac5f8a5e2ef177bf4a6862c15c707ef6645d1439b4fb97294
MD5 9be5eac81638115bcb74533f272a63d2
SHA1 cf90d5dfde6e842acfa0ac0152d174e7ce0fceaa
SHA512 ff1404d328ad474dfa9c097f63ca0d8c58063f5cfb3ee9cb9c4fba1acf4b66e7de62e8eceb9d17883f99f6aa72e653cdbb0009713a76b1f081616441e50b8793
SSDEEP 24576:zG88u8FpJqH1bzria7/msvwoUQ8qrgohJ/rciJljHQeHr:C7ZFPqVea7/hvj8qr1Jzvwk
TLSH
T1A235F16566E501F1D47BD1388A824663F6B2B8201364EFEF07A88B551F336E54F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 32f28951085c8d3331175da276d70f78def9ea9f627895d051dc6beece2092a1
MD5 57d406ce94b7e6d9e8315aa1ade269ec
SHA1 6edb6e6aeb5536a636295f5afb59e21fa07229f9
SHA512 c833402554c6ff9d65b1ca899bce01714d79eb728f03fa4f66149afdf4ec065fa3a8cfa54e114fdb67402ad4f7f27185090f9509f044683375399db9c351471c
SSDEEP 24576:qPUr+NQgvwoUQ8qrgohJ/rciJljHQeHR:qJQgvj8qr1JzvwW
TLSH
T13405E11E66AC1CE5F67AD17C89828219F771B861171292DF02E1917E4F339E8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a42ce76cc851972ab7b9ac635f475e40440050e1b8d5db7619a748525e56c3c3
MD5 27e8c1ada27d63684c4708b8180dc01a
SHA1 6199a9dc6227428c006d3c1410080e494af6f797
SHA512 68feb8d147c5079d45157751c7500316e010568a1d3650fc62b46d024b248ce75e331093393ab1ce3525a92a9b01ea5ac65c963d11129e2d9cc2b8ca3218f7af
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwvj8qr1Jzvw7:YG05lO43bz8qRJTw7
TLSH
T118D5BF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3e8c3ec5ff5bebd87d6bf359f7959cfa8aec67707ae12ccf4051647d604fcbc5
MD5 613eaa28fd81702d1084cd796ea7086f
SHA1 43e8faa2a63741fb9c03e7e4415a88faf094fe79
SHA512 987c9d69aaf9f12f499c97eb832b35e047a2dbee64af83ac0dc4b1a6d5a1a3866c268ab49339e5d001eb08a5e0c48f193bd3c14efa5ab346eb5079f147b3f63b
SSDEEP 24576:Ffa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2vwoUQ8qrgohJ/rciJljHQeHD:Fa5POZ3+Jt2pasx2+mYvj8qr1JzvwE
TLSH
T1C565AE5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 871bc568ea0a9283ee79f0662f6daf107033b315c361eaead6196ebefd82eea9
MD5 20494eda0d601d17f3f9b38db12893a7
SHA1 1e024f33f1218cb88e39aaafb9a22c518f1577b1
SHA512 04e568b36462104f59d7aaf2327394243f58d1545219583a5427c9c7ca341a19c25716034ff12601c380868b3f53414dfc5837d78d3e8bd8d00e995234d25355
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkUvwoUQ8qrgohJ/rciJljHQeHq:qNc/zEOVHFBvj8qr1Jzvwl
TLSH
T17D858B1623E901E4F5BBE1BE89679546FAB1786413308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6630dfa88336f5ad89a15f9299841dfc1d3351ce1f9422677c0d02bdefd2bd7
MD5 b2cddd3bfa71816f70adce93b6c30ee2
SHA1 68feef107542b01a6c5c8192d0398f21d5ac3f93
SHA512 77ce51eb5cf50415bfa77599269cb848a0de15198f0c7ef0c52a76254602458c1e6a7e0623aa42dfb08e411b5fbb95c1a510138ec0a182ee7753bb667eaa7c8b
SSDEEP 24576:48kNvNnaFeYhJNtmZBmfvwoUQ8qrgohJ/rciJljHQeHz:48MwBtOmfvj8qr1JzvwM
TLSH
T15A55AF6EAAB806E4D1FEC6B4DD238512E6727861173293CB5390C13F4E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 fa114f541ff11eb1519fa624981cf1156c23d25bccaccba547e5f27812db3310
MD5 3efcd6227b7a7035813223272afafebd
SHA1 b016b855176196df160ca960b02278458e949426
SHA512 18a6a251eb8c7c04bfe3b119f2d2c0e6082f4b028f8a87b33a4f988725a505db7ac44f73409eb54b9f14e7b487672739c4430d71fd52d5c66b1cfc25240f092a
SSDEEP 24576:GD3FHshBIYQgAPvwoUQ8qrgohJ/rciJljHQeHr:GDVHeBIAAPvj8qr1JzvwE
TLSH
T1C225E17DEAAC04E4E57BC1BCDA538506E7B138A8033256DB02D4D1BA5F27EE46D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1068-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1068-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1068-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1396-105-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1396-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1396-106-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1396-112-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1396-346-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1396-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1824-0-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/1824-42-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/1824-1-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1824-8-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1824-7-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/1824-25-0x0000000002050000-0x00000000020B0000-memory.dmp

Download

memory/2132-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2132-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2132-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2132-15-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2132-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2180-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2180-207-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2180-52-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2180-45-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3300-71-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3300-72-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3300-78-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3300-308-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3824-323-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3824-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3824-84-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3824-82-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4304-69-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4304-63-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4304-56-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4304-67-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4304-57-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/4384-131-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4384-327-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4384-345-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/4384-331-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/4384-350-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/4384-421-0x00000000007C0000-0x0000000000992000-memory.dmp

Download

memory/4384-129-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4384-137-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/4808-95-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/4808-324-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4808-100-0x00000000007B0000-0x0000000000816000-memory.dmp

Download

memory/4808-94-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5232-328-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5232-326-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5232-330-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5232-124-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5232-118-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5232-117-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5908-27-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5908-33-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5908-34-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5908-37-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/5908-39-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/5908-26-0x0000000140000000-0x00000001400F0000-memory.dmp

Download

memory/6000-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6000-155-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6000-152-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6000-148-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6000-142-0x0000000000730000-0x0000000000790000-memory.dmp

Download