b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Size 5.7MB
Sample260831-bvh9csec48
SHA256 b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3
MD5 a610eca11951f285037b198ca4d55637
SHA1 c1f0d58c2b929ec2c0ffad9bafcd0b84c7538df2
SHA512 326252b1c57acc218d2280ad57a38639ed618638a1f1da7429e86befcc354c59209d39679bd367cea81114607728276a84ad0846554c4778d4fd54a030e7b3be
SSDEEP 98304:HlufqmLUsV/dgAHL2Dib7a0MBrOA7YCsFW/+Csaw5vt:UHnWBrOuYCw657o
TLSH
T18256CF41FB8585B1F59201B0697AEF7A983DAE29573084C7A3D11E2A84302D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4092	elevation_service.exe
5616	elevation_service.exe
2988	maintenanceservice.exe
4512	OSE.EXE
3336	PerceptionSimulationService.exe
4392	perfhost.exe
3012	ReFsDedupSvc.exe
4272	SensorDataService.exe
4992	ssh-agent.exe
3236	AgentService.exe
2488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\wbengine.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\AgentService.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\vssvc.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\vds.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2d62b45d209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\system32\msiexec.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000364015ffe738dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5979bffe738dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eea5fd3ee838dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000796171ffe738dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005645cd3fe838dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TestSignRoot	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\FlightRoot	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedDevices	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\OemEsim	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe
4092	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3012	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3012	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3236	AgentService.exe
Token: 33	2488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2488	SearchIndexer.exe
Token: SeDebugPrivilege	3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Token: SeDebugPrivilege	3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Token: SeDebugPrivilege	3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Token: SeDebugPrivilege	3968	b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
Token: SeDebugPrivilege	4092	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4064	2488	SearchIndexer.exe	100
PID 2488 wrote to memory of 3172	2488	SearchIndexer.exe	101
PID 2488 wrote to memory of 2512	2488	SearchIndexer.exe	102
PID 2488 wrote to memory of 1236	2488	SearchIndexer.exe	103
PID 2488 wrote to memory of 4984	2488	SearchIndexer.exe	107
PID 2488 wrote to memory of 2868	2488	SearchIndexer.exe	108
PID 2488 wrote to memory of 2720	2488	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe
"C:\Users\Admin\AppData\Local\Temp\b055ad0a03a93219ec1647eea86e4285c00330d9db76a2a0e314b163286681a3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5616

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2988

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4392

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4272

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4064
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2928 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2924 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2928 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2868
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2924 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d0faa9feae7049efbd7fbed639c3c45a8ef2953c7deb25a79845e507f96a2a3f
MD5 c473ef6443197410ed983c7781ebc981
SHA1 86566ac26271c85f9cdd8dd38cc92ad2de8b32ff
SHA512 26d6b5735e02c47cae52569ebbdf11c37d31b0583ddf21508e798760b6bab1accf6a5f8aacfbee10a61392553e785eef640942d25b38440754213af3fe430e59
SSDEEP 49152:sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXFRXhsH6N25vOLg:W3q6HjBUsaw5vt
TLSH
T199D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5731bcc6ffa273dc147dcd4aeff63c9a29760315c6b7c85a7f1e0c01066b8fbe
MD5 dead9a69b28fe2ccc16965a137d51cb1
SHA1 3afd5cbfcb97c35353e841fdaef92707283853a1
SHA512 48f8477593cc8796f0216b0fcfbee573fa1c82739ca8648de7b3707632b4c51c9845babbf082d325400568894c1d5fedfd468689fe0e4bf9f9ad43abdeb43398
SSDEEP 24576:IXYfDtczA4YqkiXhs3cSkp9NH015irWmeaLguI:ftctFRXhsH6N25vOLg
TLSH
T10575012973D108F8ED678138C9A28501EB73BC9147A0E6CB03E49A665F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 3ddb2f6559de931fd6e218795162a9c2ac4149711b6336331fce16199f19e6e5
MD5 95727c30566b28a46376b6e26ff7ec56
SHA1 12ec53b8002ea7a4e489d10e5795432618dcfe59
SHA512 43625829de5b1bc2700fa1100efbceeb9d6429f7eabea21a807447ed142110925a0381dce5c55794a934638f0de95db0d4646f65392ce4173e84475199611524
SSDEEP 24576:F0Le5ji0hmxirMPYqkiXhs3cSkp9NH015irWmeaLguu:FPji0AcyFRXhsH6N25vOLg
TLSH
T186859E26F6748371D073C0B9C5D2A69AED7130825B3089CB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ec3991a74db8addfe54a1accf1dfd476c0b49667c09d87ba45d5b746b2a42ad4
MD5 33534b7a339466a5c7dd29d0f1ec2e52
SHA1 805c0ac0334679096fa6fc96ab5b601914d51fc8
SHA512 edc6e6503f5ade6911aff70a8f0f9326644a2363b7b1cc2e86b666d2086c011ab248982a83f6dcef10d13a74238e6de04fb52bd00f477631db426bf24c98a0df
SSDEEP 24576:Ra7/ezSC6vUyD/aqgrvWE6q8wyudYqkiXhs3cSkp9NH015irWmeaLguG:Q/ezSC6vUzPvxHjy+FRXhsH6N25vOLg
TLSH
T10D756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c4c0c538638349c988d33a16648440d5f38bdbf829d887f3e993915e6c0c150b
MD5 363e06cc03edae8221c2bc4d3a29387b
SHA1 46b0c9dc0b91dab887bc23fbf93681c015f8ac6b
SHA512 d0ab92c1c5d1f7add49ac513c69ec95433cada15b42ec79fa7395177de4f8d481f35544016cd945b685f00a8bb85356c61987f8c5f88c2103dbb65c46a85f94a
SSDEEP 24576:5VbqPb88hv/l+68YqkiXhs3cSkp9NH015irWmeaLguG:5VO88hXl+LFRXhsH6N25vOLg
TLSH
T175559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 58ecb5aefbb1ce9fdedc732fefdc17ede96e5e3673fb879957ed4d49ba6c76b9
MD5 d59562db1f1beb7582133c1604f257cb
SHA1 641d02e045fe29a8a2bc5047bd8a12cca7d34885
SHA512 5e9f469533844b945f54536bbd6d6fd370c73fcfa9def58aeed002615fea8d5efe8fb024edda9c9bbdf812cdc8a6cf98e82c94b8071e143ae33ec0fc65d60912
SSDEEP 12288:7RRDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBu/:7RzYqkiXhs3cSkp9NH015irWmeaLgu/
TLSH
T13955235367C6A0C0FB9B057003D7A616EF80DDD16993D05BB2AA3FEBE474A60C87B161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0c34e302589f7ad976bf42d66f084cbe2ae5c9a980d23a73fb0dcaf0cea4b86d
MD5 28649e6e33a19e6bc38c57485807b651
SHA1 785ba07e30f4956dc4a06c5e802ebd20be3284a7
SHA512 7df9e6a13bb2eef04b23f47685c073f3d87561722431713ab560dbc8066f7b2994b7e6ec813986ede29d90d3369da79ffb16da244f87a7a7e8d9030a56a0f053
SSDEEP 24576:AJIUUYqkiXhs3cSkp9NH015irWmeaLguy:AJIUUFRXhsH6N25vOLg
TLSH
T13E75CF3BEE28FCD1C67A4DB857918600E76278704B62A3CBE175834EDE235E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 87ca58bbda9fef3aca7c12dbc9ab234d84b61806457038af29428f2183021807
MD5 f6fae152c45c9c6c921ac7029e108c7a
SHA1 49e87b0c1c89183fd2aa08ecc78de86de30d3477
SHA512 a00e56117c9cb61fa6c90a9f53e36974cc444550e0def822d69d75374a2067852e2c875b3c2be418ae479d5a318055e010b13e5bfe8e4e1185a11e144ae4b4af
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THn:4QvGAdlCEL8c/yRNw5Cfsaw5vt
TLSH
T125267D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e3c4531e88ed488685add559f0b5ac3812d3b39e17d839353601d8a9865855b1
MD5 448619fe7eda967e022e807e96211432
SHA1 a0f07230b1a9d09cd035d47a2e5734e543a63d35
SHA512 d8b61985e38d2af55a478e28cabfff957df7d7058d91ce92d9595f5ebb497d2ce6637ab2b71cb0448a8d9d2b04bd8abfacfa0971ef3a3b58bf00ea38309d2714
SSDEEP 24576:UdewsAjiYqkiXhs3cSkp9NH015irWmeaLgux:MljiFRXhsH6N25vOLg
TLSH
T17975E031FE75E032C77B0DB20B26D716586CB9604B6218C3F3E85E9E99302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bb491f2508303f58f80d4759311f60969e340d4fab4891a1a47a5fe9ca6d7c6a
MD5 3d8a3fa251355ddbfcae21db4333967d
SHA1 d13f7dee25959c7707ba5cace8530a2333803b26
SHA512 8ff8c7f630780401f2af0a8de40d2f55cf47e8b5b15e74263a9212fac326a18f975addab29ff96db60bd5c8f6e3ca699642d61cf463a71949b30c7cb502f72bb
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHC7o:OUEtQevvqc2W1cpV2EI32f
TLSH
T195474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bb658f9e3bc61c91ac420a3aaf34337fe3b1bceb939d6b6f6c80fc7dd4bb26e5
MD5 c52397e55696f4e02bdc102d70d8b2b1
SHA1 7c2394f6ce395d545250a3c575f46781b0602b3c
SHA512 87e4ddc5ca09477762da844fff8932ebcbdd01ee92205bb1ce3857a0887c7e6644f529af400ae914337623cbc8e5412448e5be3e02111c835ef06c834c14808a
SSDEEP 49152:ECbRquA/m2yL5zLfFiV+XenmE3/zCFRXhsH6N25vOLg:Noq2Vjnmrsaw5vt
TLSH
T11DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 eec892ed11e8dc346317daf689c97166c9d206b498f77303daca7f31c5545473
MD5 9196387a091f2d1c2e72cd09a316bfbd
SHA1 c152fa3747b98b5c17485a15b790cee4b76690e0
SHA512 6a0b634a9e857819558f89a3160afc6ffb3b0dbd97cda3655b6834b700ecdb4d1e7e9886620dfd9289ed45d11d30540e6bf4c683936eb8726eee844782cc24b7
SSDEEP 24576:OAhGLJIFoiwtA5l7S53pYqkiXhs3cSkp9NH015irWmeaLguy:OAMyFoiq55FRXhsH6N25vOLg
TLSH
T15A35AD81E7F951D4F5B3AAB859B69171EA72BCA65E31C20F2160D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7fe51ef8415863c0eee81d4a86408058320862abfdbbf484fe13f69c0c597ac7
MD5 7d4a1d70b451848bde7f5ce7a042586d
SHA1 4035f2604d12c5e0945598af833fcba94e783534
SHA512 bb0aae4ea0f9ee33e847e7427ee1916decabef64c08cb648d20966df29f7b3c84887eb2a7765d0c6d312497e0fe9e1165ae4932120c14803d68f133b4a693e84
SSDEEP 24576:uwuoOWeYqkiXhs3cSkp9NH015irWmeaLgu0:uwDOVFRXhsH6N25vOLg
TLSH
T10E65F14677E51CF8EA6781388697C136F7F2BC412A21D61F1360C65BAF37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3ee2a3331e1bf2db759f60dd83f1a27542b148a863b52b56370299ef57978242
MD5 e16c8b9a0d69812b20cba4f77cc43a50
SHA1 fba964d7d378e03946d4597eaf4a2d078f323fdb
SHA512 b81a0fa2ee605926c501ccc61582447a595e1a3e637a100c43fbce0e3483c476bb13b2f79d15e45d8c25e45f1fcbda422fb890e20743530700292b7cc5c3ae06
SSDEEP 24576:oZuHYqkiXhs3cSkp9NH015irWmeaLguP:VFRXhsH6N25vOLg
TLSH
T1DF55125633D470F4E6A7417846E25605E7B1BC92277283CF22651BAAAF33ED18D3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9493133a655938f881300258d1551060e616b1f66f55dfbe83242aa738e1976c
MD5 715cd5558218b5b99afe199f57c512b2
SHA1 e8eda0e441c88999b60bc68585919c65bac0887b
SHA512 fdcf14355a3d914dfd016a6836694edebb8f60b1f7297a59ddf35ac80f2d97f0c180a9bb733e61ac3a2776d1078dde4361072057fe0be26efeeb9a2b4630633a
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:TQRQyi36YOcPQLvw2gAf+PN3osaw5vt
TLSH
T187667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f6de36f4fb5a60694070b1233102b8854319b16c0fccd7f2dd7bf2fbe1a529d4
MD5 1382f8409769074de69d8b79a313f7f4
SHA1 d80f917ebab0ee3e7c6590d26ba667c61b5dadd9
SHA512 a0d49785c871de4755c5131609239d43ca0220bb1c6199f766cda59d38b089b58cc688571a83b80e7eac8a0dca3135f14f0b293f2c5b7dc3e2f67c3ce2062322
SSDEEP 49152:Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uj:gQRQyi36YOcPQLvw2gAf+PN3osaw5vt
TLSH
T1F9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 50035873a0f6d26d675c7e29069ab628d106813a0b2c50425e9a5e1aa3c4e853
MD5 db05b9738bba4174177cf70f1f074fbb
SHA1 d160471a5c282463b274ec6e3e17a449d46c7042
SHA512 c126a43ca8c319482dea3938a3add16b1638b91ad163cdfe10e7553268927e987e6a48f91f473388b9c64d3a5c4fde36ca48a58cb78b1600e6cba6cf7dd57080
SSDEEP 49152:468Qg55nhheWu7PNU3/yFRXhsH6N25vOLg:CthWRc/asaw5vt
TLSH
T132B55933B2F200A9C44DE1769F4A873196D17C718FE1E3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2e9ed92718a25863f3e79746ec9349fab7b56743221ce76a7fe7ea32783608f9
MD5 fac4c29c0781194be8d2f7e970573d8a
SHA1 6d50a6702419bb675477894137f125418b408120
SHA512 d193cfb2718362564fd9bdd181cd69af364767da404bf65d283e4abbb9b6653ebf109054983db6ca0ec39e7f57caa4e2ef98bd41befc2af104641b74cf19d80a
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99l:Iy5112gYy5azzVvL69nLKnhZ1saw5vt
TLSH
T1F1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8b67ddac9af100a0ea7bb2d006640f476d0327c6fdbf8ed2ab1cbd14dd5b80f8
MD5 4e2f55ef274457190b4341c06a9f7892
SHA1 e14c306d945a9ef2360906f77969fd8868e42ed6
SHA512 0554c6a7316cdff48e35c2c140c90288ba06cde6264c95d78ccd09358296ec735ea66c5951ed09c68d1dfe3a4d64467cc32f570cd9ecd5f20bc17b303e516d5c
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glIFRXhsH6N25vOLg:Qu6JmVxd2dQsaw5vt
TLSH
T144D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ee2d47e15823dfde5b86980423579425d890d9e971c5995c6da95f889c16330a
MD5 8e48566f6843cb5f6c645b8415d8ed2b
SHA1 48547c67be1ca2cde4f26926f5f428fad19ddc4e
SHA512 bdecd1ffc2e63d50395aa5c06725f4b5d3224b124228458ca48cfb2affffdf0c0e9eee127a6e483f402d35e35c7b304aa1bbbb85a288fb0f3a13ce8ea14d60c2
SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4x0FRXhsH6N25vOLg:UmifPbRrsaw5vt
TLSH
T1C0B5AE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5fd4fc7ebf0d7a644bf359898aff1b5d7c131c4ef25330edfee9923deb6af89
MD5 86cd3d751bb8939280d62c3bfdd708ed
SHA1 3ca8366bc2b29c523b130f1d8f0221afc9526c62
SHA512 2d3f9f4b68431eb1f656e23c36a7eb608f76c9816df37c7b587f77867f3172711d87691d58f8fa89046c1b8e146eeaf045791174e12f4e42d6d603b84b5f2348
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqHFRXhsH6N25vOLg:35dKTi61psaw5vt
TLSH
T123C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 15a49863ab192d9985bd8b0136d7baea96a1b50331ec361d1352c0ce232471f3
MD5 ceb9909ae50a6ba6dd4940cf5f8947e1
SHA1 cf72a3916a7c23e604f573fae1f9f85c6d73e692
SHA512 d2806511161af96577700557c20927841e6e3b8a164f68f80dddf7830fa551104fb3508072acb31f87e9006f859909e197ad9f4c94646ebcb864f50ff4f6bb89
SSDEEP 49152:OhtSn8EApI0figngiDn0AP5w4FRXhsH6N25vOLg:PX2iyphXsaw5vt
TLSH
T1E795BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 720d4bbded88d3ffeb9b1abbada03e91f7b1e19cb187e4f0c021fffc0adfcf29
MD5 cac05d5e6aa2692c9c02df0eea48cd39
SHA1 ab5dc316431b1789d60aea0d392122eb1a1d7e68
SHA512 7ac8b5f043683c494e821a48a992799bb6e5cbaddad89c38624f258c96304b5e0ffa718d7ae003314812f51432561aa6c8548858d6b8c8ac642a80b268f6467d
SSDEEP 12288:JZDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuO:JLYqkiXhs3cSkp9NH015irWmeaLguO
TLSH
T13155235277C7A0C4FB4644B003876606EA80EDD675A3D0AFB29F3E6BE575A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 831939783e5649ed18d0900b043e9ae1a4415ac39005e72ec8cba0e7c85b3bb2
MD5 7996d37147df1c582ee8fefdd75a4ea7
SHA1 cfa8495274824af5a2db3fec2f493d963fe535db
SHA512 f4f6ae4f494e2156c68678d9c0c85b6c205f406934a5a88f70cb63a7bc677e9a49654ad3de3817afd64f549d5739b32a0d955b06f91e448c5c13febaa4acd4e6
SSDEEP 12288:GODhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuE:GGYqkiXhs3cSkp9NH015irWmeaLguE
TLSH
T1A555235276C7A0C4FB0644B003876605EE80EDD675A3D0AFB29F3EABE575A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 86069489527f48182fba91e2d483e41bfe69e823e6ceb5cf931d1023c43231dc
MD5 5ea31cc6c37bf5a22dea4cf5107c1ab9
SHA1 e733d99a454415fbe7b8175015db1056569690e4
SHA512 ad5a2d42bdd63e478c859a70dbd1fd15314e08b47fca5ef58cc97270bcde8e2d71a67f8c2f6ec460f63b0fc157f953fc77fcd59610ef2d1303e458c5099f17cc
SSDEEP 12288:goDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuE:gMYqkiXhs3cSkp9NH015irWmeaLguE
TLSH
T1D855235276C7A0C4FB4644B003876646EE80EDD67593D09FB29F3E6BE475A70C87B1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9877d612d138fa973e11d350e53b2cfa766884424d63e750430a258e08b6f3c1
MD5 7b07e10cf8768b29d3cb0e04a3b695e2
SHA1 eb500fb6f7e410a764e86b9237d06cdbf78451f9
SHA512 fa463e29ad1745351b8dab4a3ff5649564db1bf7987809fef1f4b180403c217c07c0241d564bce18d9bea26b3216ee999c0fc9970c1fa49a9a5d4c7a5f7d9c46
SSDEEP 12288:wVrDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuX:UYqkiXhs3cSkp9NH015irWmeaLguX
TLSH
T15455235237D650C0EA5781700393A215EBE0FCD2A773D09FA2563EABDD717A0DC7A260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 da98bb13c31ce261b9b6475a8705555c5ee18644d64f0f56e288ef83090adeff
MD5 22c937c4b7b5a58cdb28ffbf6929922f
SHA1 1264028ebb9aa4514ea06ccd3ede2cdf4fd0c907
SHA512 eec463209a30bbf6a16f460a50d36a2e90ddbb67beda56ce1d7803cf1825c1535a941e5a79fbc799f3a633a50139bf04e088d3493deb157f1620121c4a93e0f7
SSDEEP 12288:KDDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBum:KxYqkiXhs3cSkp9NH015irWmeaLgum
TLSH
T13955235276C7A0C4FB4644B003876646EE80EDD675A3D09FB29F3E6BE475A70C87B1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0edf7b1e0f10e51a688b859b33a528eb63839593adb65b69701f73c05c00c69b
MD5 d868c433276bb3cb00db0d42a515c6c3
SHA1 3103e02ccc997c9b97f260a22c4fca385926d516
SHA512 e1e47581b274c2274fcb64d2c206d9949c560f430fdc223e1486df6c6a964479ecf14304a1fdabe87d275c3cfbfe029a30dfe8a4b2eaa86df8d5c9bd1c52def9
SSDEEP 12288:i6DhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuh:i6YqkiXhs3cSkp9NH015irWmeaLguh
TLSH
T11D55235276C7A0C4FB0644B003876646EE80EDD675A3D0AFB29F3E67E575A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 124825fddcc52e4ee1228a82cde2c3cd51f6f2d5e8285a4cdf8157d296340806
MD5 cebd48e8c2ef656a80f3e6f6536920eb
SHA1 85c1942bc77778b219da5bf82f6d85a0e0cd4c64
SHA512 cd790069d6cec801bdfbc7edac3c3a9fdff9865138ae3a477e0dae04aaefa6d5d216ba9591b6d0decb487399ff5a8768cab6410617b4659245f7c204a320ac7e
SSDEEP 12288:KmDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuv:KuYqkiXhs3cSkp9NH015irWmeaLguv
TLSH
T14A55235276C7A0C4FB0644B00387A615EA80EDD675A3D06FB29F3EABF575A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7bb76a3871789e1a0a7f2dfff2a5ce870c3b5e279089339d1821c7d854a7742b
MD5 9bbfe4d09905d0bf472b5a91f5273474
SHA1 b20e714e00c56337445aeb5dad9dfee5fe68074d
SHA512 e0533b9d172de83509bf6e7215745efcd00549f13eb2df97706d415f42a626475f234a240eddfe753d9b22569a5d1d162cebb78f7379f17f56f32cad64aed7f8
SSDEEP 24576:nZMSzFVSOmYqkiXhs3cSkp9NH015irWmeaLgu2:nZMSzfqFRXhsH6N25vOLg
TLSH
T166750295B39018F4ED67813D8A569906D6B2BC5A0BB0C51F13F8366B5F333A04C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 260061e5b257cb35ec89bb374762af14cb8e9bf42bf68b4a22631fc3c523d9b9
MD5 9e77b850652e8345e2318cc3dcfe34d0
SHA1 7f8dba691277ce4fbf93f6dfaa9f38f344791e46
SHA512 fdabf7a8725fb176f56c6f861d7a410499705aaec78ec950666f2a363c4fb109d14923c56298b8b9a7d81c538378e13dc29d78993f33460e413865d16e86e321
SSDEEP 12288:lNDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBu7:l3YqkiXhs3cSkp9NH015irWmeaLgu7
TLSH
T15455235276C7A0C4FB4644B003876606EE80EDD675A3D09FB29F3EABF575A60C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 da94457faa4a1cb5f3ba274db7f265bc14d80450c68060bf5dda91f97ed84007
MD5 66f89edd29f29c0ef813e44dd8bcee20
SHA1 04ca6b0b4fbf245baaf6c15f0a1858db21f43ad5
SHA512 90807a90b88e9a472fa7fbf74fb9539f9fa3f1c1d6b258fbb7802f1e4486606f21fe04cf9b49e4cc640203cc1e3e6efc572deda488a34cf01e7bb72fb7d8383f
SSDEEP 12288:lhDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBue:ljYqkiXhs3cSkp9NH015irWmeaLgue
TLSH
T13855235276C7A0C4FB0644B003876615EE80EED675A3D09BB29F3EABF575A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7e510a7a676b10e6984f604617b40cec2f3441045ce51be0bdffd82096f4a649
MD5 033dfb0b360697d794a49e02ba02fd73
SHA1 ff7e06e04a39b57713491c729d5b28ba7d9fcff4
SHA512 90a917f38b953cb27a7825003da7157c24f6f00791ea3ba3908306d2a625bf108e1f9aafd8f7c96167f80232e6beab029c3ece851c48e69b100e27f7a0c388a4
SSDEEP 24576:tzySYqkiXhs3cSkp9NH015irWmeaLguG:t1FRXhsH6N25vOLg
TLSH
T1F365021773A230F8E667813486921A02F7B1BC72176189AF63A417776E376A09D3F770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 18ca6c1efa0fe043470f6d0c29a9438f34382f723167e8bb87d2ecc180090f32
MD5 44528f5ca4a300e00bcbc80a387b9a14
SHA1 b8065d8bd07fc454afb3cd34020bfdb26c529e36
SHA512 a3cf3be54ebfbee6d2be28e60929534c964958e13541b74921a7915278603978551e0393fc692abd1e6a059fe688c214928cb33a9f2059ccbcf6772402b25357
SSDEEP 12288:cNDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuo:c3YqkiXhs3cSkp9NH015irWmeaLguo
TLSH
T10355235376C7A0C4FB4644B003876606EE80EDD675A3D09FB29F3EABE575A60C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4004bea418d5bf0020078e7d8fa5a7985b56b6e9656964dd21f698ff5c4ae587
MD5 25c450ec3168bcdf28cfb37740763823
SHA1 e2c8c9d21329eb08bdf3f9e53ce1846a80b8150f
SHA512 2641a623c4a73470c5758fb5fb740d4f0e389cf4752c314fddc2ec1624e425854bec0e4cd2beab431862dcc1201434c108f361598339838b726dad3330ffcc60
SSDEEP 12288:xNDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBub:x3YqkiXhs3cSkp9NH015irWmeaLgub
TLSH
T1EE55235276C7A0C4FB4644B003876606EE80EDD675A3D09FB29F3EABE575A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 428226dbb641d07f520627b09be6167349516dfaad669876a354f83325c4a2fb
MD5 c8a0db917828ef7c8ba8547b6b69c5dd
SHA1 cb0c76dddbc9b44f0b7b7abb88b039dcb883d12d
SHA512 43a82eecf664ff60daaf8c5fede091f863f5865bd4e89eaa17cece0b4ccf2571aa4c3eaadb4fd22ba8618aa3b8264b91c346fd9653c5e6a0103f83e66859467d
SSDEEP 24576:TzySYqkiXhs3cSkp9NH015irWmeaLgul:T1FRXhsH6N25vOLg
TLSH
T14265021773A230F8E667813486921A02F7B1BC72176189AF63A417776E376A09D3F770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 49b46a04c275b2476acfb5c8916d5e3724206c81854cb8bcb807e649b34f73ae
MD5 8d25348c9ed63a2de5d31e5888bead21
SHA1 5dbbf972cf81589e63b54167fd0f2bf68ae3cca5
SHA512 fed8eb989ba12a4615d3d791646d1aa635d83fb768598a7620d78621d59af36caab92e8a042d59ee7dbab5dfe7c80a8adbaefaf6376d7f42f0f82dd606cf30a9
SSDEEP 24576:BTHaLl3z0zDcYqkiXhs3cSkp9NH015irWmeaLgui:BT6LljdFRXhsH6N25vOLg
TLSH
T1E37502A5B39018F8ED67813D89568906D6F2BC5A0770C51F13E8366B9F333A05C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4148d5355d0fb71f634fd4e1a4ce67f56465d3a4ec76eff631ef0c2effa71dfd
MD5 49de63ba59b577c23b13ede975848cce
SHA1 37b58a95ba4e8dacea2c036f9f907bef3b7ecab6
SHA512 6d38205e80f5986828fbd69028e1b1ce992d0d4c2e3b4c12c486b96f9c0feab126ed98588d55b5f8ade1b2ef0cd5f760744daa5bde2d39ecc350585cac5ad9cc
SSDEEP 24576:L37d9CHKy7GZQYqkiXhs3cSkp9NH015irWmeaLgu8:r7d9CHKyaqFRXhsH6N25vOLg
TLSH
T1F385D090F3E410E4F1B78A3589765511DAB67C9A1B71CA8F03A8265A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 44aa82d5ca9d3aeda8031ac0b223d734aac61716bc2b37a60adf8467d4d8105f
MD5 3fc047486799d24443f28fbb397b113e
SHA1 aa915b8345c12bec61c755684ff71635c340ff86
SHA512 ceeb77562400462bee1cf874391e3a053c6650e55aa17e9dfba0a30637d2fb81f0070c7a801042256fa7e4dfaa0f7bfae0a120ae1f195a666113570cfdda9a6b
SSDEEP 12288:fIDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuI:fsYqkiXhs3cSkp9NH015irWmeaLguI
TLSH
T12055235276C7A0C4FB4644B003876645EE80EDD675A3D0AFB29F3E6BE475A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 499bdaf0aab33e3e531e53bc0b80f66bc6aaf0c50df3efe01350123ad9d6bc5e
MD5 2e2613c673353d779d434badbc270ec5
SHA1 54b22a5642360c678f7f37134c89808aa1c82b9d
SHA512 ffe9cb9fb8f7669cf782f3fa783b63e21aa9c9a45c19a19c097758e16d0db9b531edab8d9a0042b5a8127456d3f137c803811adcdc2273225ef6113f62038cc4
SSDEEP 12288:QCDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuA:QyYqkiXhs3cSkp9NH015irWmeaLguA
TLSH
T15355235277D7A0C4FB0644B00387A606EE80EDD675A3D0AFB29F3E67E575A60C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ccaf23b9272a71c1abce7a2fee162dd9a3350a63ffe24f6f8d039e3844bbe814
MD5 a8a356bbac661492f136eed8853e3b7d
SHA1 e3de6c06980e7c51907b4628c9b8582c7a7de158
SHA512 ec7008b6ec10469d55da83239210f5409389430b24bc0de3190e8ddf1fd51d321ad23b5f0d4f07ebfb6becf7d6a8de9ed560f09c04764e587be62b47df1c3a59
SSDEEP 12288:b/DhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBum:blYqkiXhs3cSkp9NH015irWmeaLgum
TLSH
T19555235276C7A0C4FB4644B003876606EE80EDD675E3D09FB29F3EABE575A60C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 39574f2fe3bd7aa853285b31a3074ba9e94468428be807aadbc4d34b4124b1ed
MD5 9b2cd070d4c940e27f7c88590dd24883
SHA1 be96ffd1d1560f1efaeefee1d3822e0ca29e948f
SHA512 e7f08b1d8cfc77f756961e99f2bd64daf1313ff594958cc2c5c225a8c71e9b13c8a372c423ddcecfa2a9f660e9b973ae553b3b830f2df80a9c1cde197a1b8eee
SSDEEP 12288:hNDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuj:h3YqkiXhs3cSkp9NH015irWmeaLguj
TLSH
T13955235276C7A0C4FB4644B003876646EE80EDD675A3D09FB29F3EABE475A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a3c184bff1bbd2a899358a3024cf1de532c0a85921d4f32f403dea1382a6b214
MD5 e87a2a6ba7d312ff525a26ddd045e79a
SHA1 0cd989934fc2e0f6e05b626dc92b1e100b69d358
SHA512 2d98e89d182478eec7d91463d7fee63ab2a3e97cae4618005dc5b72ab59a5e7e26be62e2160f9d83857f8de28661f98a4bcf94f618c7d5188ccfeabaca7541ec
SSDEEP 12288:SIDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuX:SsYqkiXhs3cSkp9NH015irWmeaLguX
TLSH
T16355235276C7A0C4FB4644B003876646EE80EDD675A3D05FB29F3E6BE475A70C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a5ae59783eddfe87f59460a1413a28adcb1b7ba155981e29e4c658fa9bbed44a
MD5 fb672d88cc2e63c459002140664a008b
SHA1 08148218d7dc28cceadde6c3d19d07522ae432ae
SHA512 8d057404bd8226c308b799a4d11355fc37d339dad99779d74f63e7a8800039d3ec9b651d5ffb33e30590b516e669703f6976f907a217edf03abb4b48e0c6086d
SSDEEP 12288:AlDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBu9:AfYqkiXhs3cSkp9NH015irWmeaLgu9
TLSH
T19E55235276C7A0C4FB0644B003876616EE80EDD675A3D0AFB29F3F6BE575A60C87B160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c003f2e20758a7774fcdd47f8175a27d20135eb2ca5ff037241e82949976ec1f
MD5 b24dfa8fdebeb5061c8e3598038a3f25
SHA1 da538bba53906c4536ac8b72ebc83444b459be39
SHA512 de38928573bc8c23ee3fc9d7ec03ba4723a889e7ef7de2e664ec519fd58807e87a87a62c5582d0455f5953e795a124ba42766f670e08e305bcd6f1ff4ed0aa4c
SSDEEP 12288:dDDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBu9:dxYqkiXhs3cSkp9NH015irWmeaLgu9
TLSH
T19755235276C7A0C4FB4644B003876646EE80EDD67593D0AFB29F3E6BE475A70C87B1A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 5fe34eeb092faa5f49c15f13e22bfb005635149226696a2a7055c8013232a95c
MD5 31eb0fbfe96b912c65337499d61efe57
SHA1 cdc0268fdcf55abc1894e6bec3ed5844ad9c378d
SHA512 fc412ac9a1e7d0b7baaa3c761616cbf78518137da06ec3149d84b62fee4cbecb5dbc7b75346ca1aabcde8e3ee9882e269fb34c4cf5aa109926d6ede7eb6a7e5d
SSDEEP 24576:3fwvok9RX6wkyAITYqkiXhs3cSkp9NH015irWmeaLgui:xMnYITFRXhsH6N25vOLg
TLSH
T12785D029EBDC44E5E177913C89B7460AF6B178591B31C2CF129A53AE0E33ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a00b6fc252c1a4b40ba9e8689dc1b90004f737c2ca9518e5e609e22465ec7f18
MD5 05de61d18e7954cc0a3446a9c188e35c
SHA1 486f2f7b5b7e669b6d3172a9e7e790aa583c7e83
SHA512 3acddd23983a706346b4b8bec8452cac72ed83d728ec16b2714d6c42632d425b659d961a38f1a785332ef1cc41af9fe68d0231785ff90352ea1a7acf6975984d
SSDEEP 49152:vYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YFRXhsH6N25vt:rySzPIsaw5vt
TLSH
T185066C56A1A801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aff17c4351e9faa589da4c6de9d07bcadee327559338f441a5c3b52188404229
MD5 61cf141c1d564ff36882e157947b742a
SHA1 c4cdc7de7b1c127ede7857bf8e21bc69c4ae9ee1
SHA512 ddc7bdd117a9dfaea7db6a02a778a0bab4bad297931fece1da8fcda2c6864f859c11c38cd5f80225dc08a5721379774e2c3b222a11e9eacd7ba5043ab1e8472e
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYWYqkiXhs3cSkp9NH015irWmeaLguq:G47JUQj1irIhCnDHUPfF/IFRXhsH6N2X
TLSH
T19F65AE1EA3EC01D5E1BA927885554A1AEA71782E1F32C6CF2270437D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c2e981ee3605022a553278d63934f10b46a34cfae05b06c781a06e461bb5268e
MD5 884ace6cd759bc797fb7c0c56cf1c96b
SHA1 0f23a651494dfa6eb080b70b779ac52fcc1e545f
SHA512 13b6fee12614cee607691ea56873afc17e0db1cd7b6138c5559767637feaf2def9d816ee10d5557dff111e48b01067a17ba96ec5b2fb68d70332375773b646e5
SSDEEP 12288:kNsf9DhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBuu:1HYqkiXhs3cSkp9NH015irWmeaLguu
TLSH
T18765011AE29811D8D16E6174C3865A01F763BC6193E2D2CB63D0FA7E1F366909DFA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 686c84050922cd1d10af5f89dbbee3e09394a353197339443520b8e90324f6b1
MD5 64dc5e2da0d399a24a76015ec72a28b3
SHA1 5a2ddd899c16ed8c38dbe4b3a5cf289e1e7c5043
SHA512 4b86c54070815c2436245028a390a0b4a298b58d3e75653df3f4e2c061929c547ee023da593295f40c4edc61f3119e15e029f465946bf173e1cb9ec0f9720440
SSDEEP 12288:q0TkuU3f4q2c4udVPmT38DyfoxuXSaRgvB+mx4BYq7E6:PT7UPic638DyA2SaRgJ+mx4
TLSH
T1F2351841762AC75FC6AD40325E32D5CCAB707D01EE056F0373C88B3F9576669BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 ecf1a9692a7914e7d2125ba85d310fe0e2fd8bd262f5860f2ff4923e6f423543
MD5 f776aa74a3c230e63321482227bb9d6e
SHA1 22b7f244fbf15528392e5d316a6a79de358dd373
SHA512 55348ee43376149ba4cdad2039c0770576aeb8b5e3dc41019e50e7f01ff5eb44fc601b70e13c7663b88a6d81da843a40367bbae1b042b4787982f0155ca1bc17
SSDEEP 12288:M2wOxNZJVaTjROA8KSCIjk7OVayr9IlptwNkCwMD1b0/Z/yYDfw4d65SV:NtZSw4U5w
TLSH
T13865E9816037A38FD1FB5072032A5B4CA764DC16B7496F22B388453AD86AB25B1BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 999d984f379bb7b364b1493c5a926f0a50536659f4388081a9a656db29fcae7e
MD5 740726399e85974faa2082aefe98739d
SHA1 2f66840f83914055155ad1e97356095ad3dfcd08
SHA512 cb837f2c4e03bd291cdde5a829bb2c420b4376a42ff61f24252fc68441bffad5a1420a3583ca7eb27dea7d3ba5200b3021cb9c57c3e1c135a2179a559132ef87
SSDEEP 12288:SF7VDhCSMvC7p+iXhsSmc61yXnNpxDNIzbMucNa15irWmeAhoasBug:OvYqkiXhs3cSkp9NH015irWmeaLgug
TLSH
T1CA55232267DAA084FB7715B0038B9225FA40FDE55B52D0DBF15A3BABE434AE0CC77211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0e847bf8eb0ccd316ac4ed37ee05152ae52908437a182bbe92a0c0c2a26d20df
MD5 4feea2d0ba109217133b46477adc3e2b
SHA1 297aad316891980f685f7bff5996cc0f765b7f0c
SHA512 52e5240baf1dbf53e328614a31b6733ce6bdd283993bed037e811667836af1cd8e895e66126f9dd44cf0ef952cc4027a9f73c55e7e91c7810d3775bf1f235a50
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYdYqkiXhs3cSkp9NH015irWmeaLgu6:egb4mBIBhGFWFRXhsH6N25vOLg
TLSH
T1AF65AE1E22EC02F5E1FAD2B88DAA4417D6B278160732D2DF1151427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 945b66bdb1f1042b973c974fcd51cad6e4411fa77ea01838c4070674998fe598
MD5 a3f79fe4e76fef18ded9d6f274a77287
SHA1 85818bc70eb21f2ba9b2991404c07d8e2dbf6d84
SHA512 fd5ea8873be6a2b2b9e2472ce3f40b1ad141f25a3ce1a9e1b27d0ab20bf11c34383b7a6552be3d3dff7c1dd114aa79be086ad38f49bd9ac3323585b7d2808795
SSDEEP 24576:4G88u8FpJqH1bzria7/mmYqkiXhs3cSkp9NH015irWmeaLguK:77ZFPqVea7/FFRXhsH6N25vOLg
TLSH
T1A085016577E101F0D47BD1388A864663F6B1B8251361EADF07AC8B561F23AE04B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 61c0f817e143b31ccf251c238d2cd06a459fde7afdab970be9a0ddf5c04a9079
MD5 cb76a26b46ee76bd724ca5d428fb5291
SHA1 710b830fbf80e0844f58fd9050f025c5c884c784
SHA512 7d5d785d2d46dd94dfe5a678d7ea9ef0974383565fca0ca741f0f0c7d87122f64c0f93926a1df271d2e4c4dc4b22486ac4a86c151a6b9d080626f51589e1a6f5
SSDEEP 24576:XPUr+NQqYqkiXhs3cSkp9NH015irWmeaLgu3:XJQqFRXhsH6N25vOLg
TLSH
T13F65E12F22ED18E4F676A17C86828709F771B8621712D1CF02E1517E5E67EE8AD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 88ae40c06ce75dc8c6319b43ece1bd3acc9b04178dba75769d6872813f890696
MD5 fb0e66d65920efb3b6a5cb8fa7985a22
SHA1 74161dcf075835866809e0a802aa3d69301353cf
SHA512 02c0ad2af2a3210868144932f5427f187dfaeb02916afb8058e46e3966159b62f721edbf35e7880aed8704a3effe8d9edd45d32dfcd17adf3f4048ddbc93b352
SSDEEP 49152:ZBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6FRXhsH6N25vOLg:6G05lO43btsaw5vt
TLSH
T1D6D5C06A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2f6411661c35bb10eccfdefb552a8c8bc219a8778841c19286730354992dd483
MD5 919b05ad0ec20d925c04f00db37cfadf
SHA1 729b6682356900c3a37c240186852abb8be53171
SHA512 31d707f8a74b9fdbe04d6c8bdc09713b19df47cc3d9371c31bcf110b3861e23c2eea91dfda1f0a667266264b813ce14503660e873c06a20f4614fc727b0435a2
SSDEEP 24576:wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYYqkiXhs3cSkp9NH015irWmeaLgW:Ia5POZ3+Jt2pasx2+myFRXhsH6N25vO8
TLSH
T15A65AF5EA6FC01D5D579D17CC683461AF5B1342253329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a52bf6547eb316411adfceb40b043621763486e89bc96e43c6678de70127ae15
MD5 ef67c7b0dd693726d8723d8fae05b651
SHA1 1a7a572ecdd8e731398d4fac267c2183ce4774e5
SHA512 d5eb852ae97431fdbf748366502f54b552e13bd78d704db9be08de45e11d2ee14759e781fa3c741c149f21a9d2b8975cc7c0a18841c6d9bdf3ccb300446f24be
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fk+YqkiXhs3cSkp9NH015irWmeaLgul:pNc/zEOVHFlFRXhsH6N25vOLg
TLSH
T174857B2623E901E4F5BBE1BE89679546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bb74025c3cf7d9273a52cfc0d5ac852573fc7c94c777b210d3f9c6b44eaa3368
MD5 afe212bb1059a8d9175d6d4c93bfc7d3
SHA1 f11b4ea9f55407cb53f1c69ec19eca3dfd6c1c79
SHA512 2592fcd4098b10c2db603dcf88569d7710efab7c1180e5d771abba84c253d1893925382ad605521e058be20fa47f13f3357820545d478dc57f3c6e4e68b3bdd3
SSDEEP 24576:W8kNvNnaFeYhJNtmZBmEYqkiXhs3cSkp9NH015irWmeaLgu0:W8MwBtOmEFRXhsH6N25vOLg
TLSH
T13155AF2EB6F845E4D1FEC6B48E238512E6727861173292CB5390C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f027c6045a7aea1f0f20c67aa54c493e53d401f754caaaa440001cf68993625d
MD5 080dc880a269bdb38fb4513e0b58aa2a
SHA1 963bac6d919805118fb4c22fbfd790b560777899
SHA512 56650a354b70e0ea0ad046a69bbca5d9b4bcd98326e39acaa14c02462c91536989a01db9d0855f980b41552a0ec57ee899eab8d9adb5a8458dd1a1159e738e0d
SSDEEP 24576:bD3FHshBIYQgArYqkiXhs3cSkp9NH015irWmeaLgui:bDVHeBIAArFRXhsH6N25vOLg
TLSH
T1AC75E13EE79D00E4E57BC1BC86538A06E77138A9032255CB12D491BA5F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-321-0x000002209CD30000-0x000002209D3B0000-memory.dmp

Download

memory/1236-398-0x000002209CD30000-0x000002209D3B0000-memory.dmp

Download

memory/2488-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2488-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2488-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2488-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2988-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2988-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2988-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2988-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2988-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3012-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3012-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3012-330-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3012-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3012-298-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3012-95-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3236-135-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3236-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3236-129-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3236-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3236-140-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/3336-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3336-73-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3336-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3336-271-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3968-7-0x0000000000400000-0x00000000009C7000-memory.dmp

Download

memory/3968-77-0x0000000000400000-0x00000000009C7000-memory.dmp

Download

memory/3968-0-0x0000000000B30000-0x0000000000B96000-memory.dmp

Download

memory/3968-5-0x0000000000B30000-0x0000000000B96000-memory.dmp

Download

memory/4092-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4092-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4092-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4092-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4272-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4272-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4272-315-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4272-302-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4272-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4272-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4392-78-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4392-296-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4392-84-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4392-83-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4512-204-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4512-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4512-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4992-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4992-123-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4992-115-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4992-317-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5616-127-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5616-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5616-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5616-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5616-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download