3b034159fbee381e1c351bbebb6e517b1fce7ef89f859309e3aba74ce06b2f26

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 23.2MB
Sample260831-sdmc5avaja
SHA256 3b034159fbee381e1c351bbebb6e517b1fce7ef89f859309e3aba74ce06b2f26
MD5 6ec95fe36d35278150aca62284622585
SHA1 1fad9d5161af60acf32a3bbc3466e8f236e33c03
SHA512 069e2886410c53233d805e524f907b3bc294d98c79c0a963e0e1044e290398b584ab9a782235b48ca34eb1f1716a0bb7db7d39fd233e63f8504fd6eda24094af
SSDEEP 393216:MSIYMNG52UkMbjGSYB2K8xvSk9GR64AEzS8bGhgpo8WsvyR8PhrqWjjFshhEZSN7:MeMNGsUBbjRm8lSkgmEzS86SpypKVqko
TLSH
T1CF37F10546E92FC9EB3D6636C6B5F403C6CC3AF5C5D2A3211A42624139F2DBAC3DB15A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5880	elevation_service.exe
2504	elevation_service.exe
4328	maintenanceservice.exe
4396	OSE.EXE
4824	PerceptionSimulationService.exe
1980	perfhost.exe
5668	ReFsDedupSvc.exe
6452	SensorDataService.exe
6924	ssh-agent.exe
2672	AgentService.exe
872	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1d97dd9a957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	loader.exe
File opened for modification	C:\Windows\system32\locator.exe	loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	loader.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa0aa78e5939dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b6cd08d5939dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8c209cd5939dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf33ff8c5939dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003553d7cc5939dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7e14b8e5939dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000465b928c5939dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
6384	loader.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe
5880	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6384	loader.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5668	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2672	AgentService.exe
Token: 33	872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	872	SearchIndexer.exe
Token: SeDebugPrivilege	6384	loader.exe
Token: SeDebugPrivilege	6384	loader.exe
Token: SeDebugPrivilege	6384	loader.exe
Token: SeDebugPrivilege	6384	loader.exe
Token: SeDebugPrivilege	5880	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 6872	872	SearchIndexer.exe	102
PID 872 wrote to memory of 3416	872	SearchIndexer.exe	103
PID 872 wrote to memory of 2564	872	SearchIndexer.exe	104
PID 872 wrote to memory of 5944	872	SearchIndexer.exe	105
PID 872 wrote to memory of 1252	872	SearchIndexer.exe	107
PID 872 wrote to memory of 1536	872	SearchIndexer.exe	108
PID 872 wrote to memory of 4724	872	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4328

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4396

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5668

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6452

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6924

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 66dfa845cf1afcc973c9d3aa9033b2d8f507acdb7bf75e53be7991566b304d1b
MD5 344c8162b9b7adadcde0a3ed990a7713
SHA1 8815754d70c203cbe5a75ac4b93d9e203f90a17e
SHA512 e958e7577797685fa0332b90a4e0a50e3100dfdffe3f548ff990f705a2d4deec615f2bf1de8e4ddd3cf7be1fb7d69460f6e2df922ddfcefac82eecde9a6b3e4c
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnQkS/Su37odjIv:23q6HjBFDFU1Iv
TLSH
T1D1D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 45cdb1ff711ac2f253ed0305c94c9b10e65f03da2acfbb53a86bd56ac059b1f2
MD5 c7aa58b91f331104ee7c9e451dacde26
SHA1 87cc762fabe3c97a7c60e19f6177b0cd268c965b
SHA512 3675db05830003af74773ea0db9b8c9a107226d74d269b4b5686d6b76054c0ca849ab8105c6e2dc917e07551fb6c473ad948cb5492fcd55fe1dc355930965d5b
SSDEEP 12288:J1XLsswWkxy2lRq2czARlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:HXYfDtczARkS/SHOp17dadVZVyv
TLSH
T1A185012973A408F9ED67813CC9A18411E673BC9547A0EBDB03E495761F332D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c5a91eace9df19f2a90c8ee22279dd8e37b9ed00c1509bbd1bdbe86689b1a036
MD5 d9d616b50398d2862fe87a158704e461
SHA1 ac93dcf7cc5435b1d331476dd6c74ae9df1888b2
SHA512 9a8bb40987d00365a4669db03580e56c9c23ae19e635762172b036361b9d8b62084f4a8ff03d10b4b7956fd3a662cdf459da29b6a0d11559fe5f5816c3e33b8a
SSDEEP 24576:e0Le5ji0hmxVrM4kS/SHOp17dadVZVyv:ePji0AbbkS/Su37odjIv
TLSH
T12B95AE26F6748731D073C0B9C5D2A69AE97130865B308ACB4286D77C3F676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4d77080c02f04036c5675183c3e14cce1382a85eaa08c718d00333800fdd82c6
MD5 2345e297891fd39efaa0712634750a4e
SHA1 8504d6eeb7a41dfa28ff2c88960da42e636f3551
SHA512 23df58fd8d511ee0ffac384ff49f8f2a30f7a4e4875143f68b6f58f053893f522b40bb1c28b82794c68805811bc50c09e329b55bf091aba014b45212ec7c3a0f
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuekS/SHOp17dadVZVyv:+/ezSC6vUzPvxHjyHkS/Su37odjIv
TLSH
T1C7756D25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c2ff5f75de0c89e25e78888dae110e13879dc444a1fd0c6b06f491fbe4a06597
MD5 155d25c1f742e30a39cd0fc2adaf706b
SHA1 af57ddbe945d04be5cbd2ecd37458ce7c36d061b
SHA512 80f2b4dea516e11e4285fe6306921c22481e8739928647cc3b908a1387ce582153e2bc7da1e1f98e20c5076d9f09810c5fc94f6731b3a740d1d85b124069f622
SSDEEP 24576:DVbqPb88hv/l+61kS/SHOp17dadVZVyv:DVO88hXl+0kS/Su37odjIv
TLSH
T12D55AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 234885d32a1af46f503c75ae3f2fe3efec6e01b07773528a417faebdc394b963
MD5 6b39e5af0d9acbd807154989b32e81a5
SHA1 d862174503da0549f339fdc33f642568c5b976b7
SHA512 42ab56f4332f83ed74ccecb79387a7b1ec278091cffe7e8f118b29c8fa88f69231efed1847f966ad2f06d3aa184512d39132f67fb026220a7d683e5e964336b8
SSDEEP 12288:5Sslms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:5SskS/SHOp17dadVZVyv
TLSH
T1C8652367B6193C87E3C7143066F844616164FEE97BE06DB94D6031BB1ABF090C8972EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 7bfdf40ad8594d08004b6229fe140b85ddbaceaf41d8f0978e83d67e49494284
MD5 28a68639143809486f328921c2f9dd5d
SHA1 0e9f62ae5e94f45b3f85e21a24fb4deb76ed1a20
SHA512 f10fed9f86da1602706f90123e1a2e8a2300a2af89411dad81793f131929665944cf79fb385aa8822f4ca9a99146eb96428943c5814ad8cd131522cc6e8aed6a
SSDEEP 12288:AeBNUbTVO86U9lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:AJIU9kS/SHOp17dadVZVyv
TLSH
T18B85CF3BEE28FCD2C27A9C7857918600E77278704F61A3CBD175820E9E275E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6cec2563452a7d34693f5d2d2b7c6be59a5e49c9d86707781568c2639dd57db6
MD5 0b7e8992e9639f346022284e2827b1e2
SHA1 53e0e03b6a26973114c33f49f4e871ee7fc7a0da
SHA512 345875223d17ee1057ee7dea31b666a4a7bdce492787cf476f62a74534e430341daba8336f3cb9f66c9f2b74e416248a99b53fd546ccc31a8af4670cc61f4abd
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:EQvGAdlCEL8c/yRNw5CODFU1Iv
TLSH
T1B8267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 8fa7651222c48211e5c4980fce40108f1c83343d79234471b92c01e267fcc206
MD5 52cfe011250790520e610f0b8e6132f6
SHA1 35e38c7181eb58cb75c662128cdf48ef21a5d257
SHA512 57bec5c940198b0b701c9469dbfb05131163149be51aac009fcbfd4e61f46c0da79ae331ba1a0ee8f5df7d2678022f576109e49f0eb91a86df6f224334e75533
SSDEEP 12288:6AwSfxL/2Dc3bDLLmt0LDQewsAjLlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3yi:PqewsAjLkS/SHOp17dadVZVyv
TLSH
T1D285E031FA74E436C3BB0CB21B75C716143CBA604FA11AC3E3E8499E59742D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6ef5acb844a422a52ee52c02ebb32e9f497fcee038b008fe74f9f3d0c8b817ef
MD5 6b400c0032966b564012802d703afe8c
SHA1 71af45fd29811f55c9dd4165e785487bf0cbd0f8
SHA512 9c97850100320369717f7dbbfdcce8da5cb9f0381d95dbff2bdfc4daa68429d22c2fedc2befb69c32dc3988c57eb3465e65b495713c025b7efa49f9f50e72752
SSDEEP 196608:sUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:sUEtQevvqc2W1cpV2EI32
TLSH
T17A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0a58514b7ec2f0b162d6691561b06893eadbd647914bfd064c918207597db50d
MD5 4d62c814893f4dbb5723d423e7cf1ffa
SHA1 2f3facce49e4feb796a5e853ddfe39b4a8b99782
SHA512 501edf2ad4fc21603f1e98da110a763afeedfa5f5355f18d4a7b5571dd909bd09daa1121b1a8b41233946e816ed3397914a40ee608c98ed50bde6cacbad8ace8
SSDEEP 49152:ICbRquA/m2yL5zLfFiV+XenmE3/zrkS/Su37odjIv:hoq2VjnmKDFU1Iv
TLSH
T105D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5a1f7add759d0669a27c8e414d672e8eb8c192e812f239b390422908787a76a9
MD5 55aa410489f7936f532ad1ea383458a4
SHA1 9ec474ac1383333d9f36a5da3650c3fcba2e4548
SHA512 0815fed1cc05363fa51b7508090194b88bde0906e2a98423eb55ad1ba9f503eb5879071588ac4c9b906d64c8b6de892501841e732125dd01d9936b55fe365cb3
SSDEEP 24576:fAhGLJIFoiwtA5l7S53qkS/SHOp17dadVZVyv:fAMyFoiq56kS/Su37odjIv
TLSH
T140359D81E7F955D4F5F3AA7899B68171EA76BCAA5E30C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e167ff222f5b575777f164b1627335f131c5413937e58a86da51e1d178b36c2b
MD5 3182c9d9e0ae073e30f6c3f90eaa4faf
SHA1 a7a0cd98fb41724f4ef0d65e6e5000f797e59def
SHA512 44694856ae5e6e6dc327a694238665f69e85aebe20fc15c9e1edcfcc8a017be722dab8a49c2958ea4b31fcab242c8ad87ac57b7be21f0ac005baea80f9f4cc82
SSDEEP 12288:emw5HEjsChNYBFgl0WDm+C+lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:3wu1OWnkS/SHOp17dadVZVyv
TLSH
T1F675F14672A51CF9E6A791388697C132F3F2BC122B61DB1F0760C65B1F37261AD2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 e53be20b079efb9cce4055521634bae7b59822f953757440c0bb6785e0c4fb8c
MD5 379fdc2b7ba687689eb565361326392c
SHA1 2b7170d2c5deaac72f832d7c4f0f713b5e42cd74
SHA512 f7e3ccb7734311aeab8052757e50e139063803cc6451a4b6f460360fdbd9a567eacd7c4165d2a4010f216deaee702e9d72cad00fd397fce1f3a88c3630813d95
SSDEEP 12288:sUZ1Iy7lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:vZuAkS/SHOp17dadVZVyv
TLSH
T17065125A33A434FAE2935038C9F44541E371B8A667B147DF1A6002AB2F77AD19D3A373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b6253d5cd34016ea4735b9be2b5163046f2361b8c4fca9ba79c203ba6dd9d50a
MD5 1a8c275ab564be9e8f88e47e9bbf2795
SHA1 9ec878dbaf46431fc5266d5a6e853161d498b721
SHA512 9f21ed566a8fc41bf87ffb452a2edd3da7c92a0d47eb98a7d6d86e8e4f6f8c7ee3269776b6a4bb53679e54987dd0e06c460dc8b601f966e076f713887dd2f304
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:3QRQyi36YOcPQLvw2gAf+PN3ZDFU1Iv
TLSH
T18A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6f82da1dc735df80fe91d3164ab5a014b1f25bd968ac034faf3aff8128ac9f8f
MD5 b4393e0053c0e5a073c9d1cb1f3f9062
SHA1 a615b82363a44d56657e9ca3e56860d484908038
SHA512 04608b41f314484334072ad2dc3f0a609a15cea7c53a5c5e595e4448a81a783fa854ebdadca3ea2739771e4a3405b8f8456aff391eb78df2d9c7b2f9d4d98675
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:JQRQyi36YOcPQLvw2gAf+PN3ZDFU1Iv
TLSH
T164667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e0162e4054d2789c4356c5abb5d1363b3f980a66ed6be6f6be86ee5165a2fd4d
MD5 71f581128b89634545760677a99a71ee
SHA1 d7ef5459328e484ec3b9f01fa4e4ce61fa56c7d4
SHA512 2ce760ad162596bf2d8052f5c57e3c36d49437d98e42e76a7fd6c3260775b94e2fc326cbf491755790f5b049e2c1233c9b159b02335b02518bd0664ed4ff5491
SSDEEP 49152:F68Qg55nhheWu7PNU3/bkS/Su37odjIv:TthWRc/bDFU1Iv
TLSH
T191B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8e44c2e656e758ace765e76f98f092c6fa0d219a69bb47108c497133caa8a3b9
MD5 f292e603d020eb940ddcb5389d37dfcf
SHA1 8f3f535764a2fc8fd2ca7bd10f1d4bf0a52d4547
SHA512 87001000de023e4594d7e6315210ef54f517a63a6ecd031a0ce56dd26392e9c7d53cc0c0ee8afbc9e367bba9e6821c336b822bdfd3fbefebfabdf1a39089bf10
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99d:1y5112gYy5azzVvL69nLKnhZsDFU1Iv
TLSH
T176167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 517099c4c9f0b2f0d4fdd8d0188a3fe231c21d6f674d89ab5365044f15e69bc7
MD5 2f6b9f0f84cbdd6667efece953021a5b
SHA1 f5daaa07d816c843781c13b7b6b94c7cbeca9388
SHA512 4ca6e032c3cfe001b8dd70a0f0a4bdd91a837bdc4db9d626e21daf9244ba971936f575a539d2def346b3859628911eaf99f33e7d72c9d204adc5954e1ec2d8f2
SSDEEP 49152:ZB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glhkS/Su37odjIv:Pu6JmVxd2dhDFU1Iv
TLSH
T141D59D13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 eb1f7ac16be88d4c8d16bbf90def84529c3d3ea7969b016246e3e37f37e369e7
MD5 f7b5720d6453af02fab9b32daf870e05
SHA1 2a1d8a6ebc7025f6994b9b9b023dd01c35137f7a
SHA512 2a72ee2b4b10e9f1a64efcd7fe7e923dc929628fc534f663dc5643c20b44ca6677c3fca8a2fd33f5a0187b2382e3427626a2d03bc30a5da4818bce73081433dd
SSDEEP 49152:a1hpsNoJpF1A6UU44CwH7R4xdkS/Su37odjIv:amifPbRKDFU1Iv
TLSH
T1C2B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 df43bf29984f30689955f28c4e17cf817cd543bf756cc21112820032eff23206
MD5 98b81f944835e094ebc6263601384dc9
SHA1 bc959d5d90be2ab000e1916777845ffcdbbba677
SHA512 ebce0ed26c922e3635c1f9a1e78e6497bb42bbe8191a80539bd25a3f0278f1b1d938bfe92c76a7844688e22ea1c1fc373397e9454bbfc1e3537c27c7f7fad433
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqAkS/Su37odjIv:f5dKTi61ADFU1Iv
TLSH
T10FC5BE13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 31c7dc6e0476a6f66067fbacc8fd3f76de40882e777a2c9aee62bb54ace7923f
MD5 182b6eecb9ffcfe6a433e4949f550bdf
SHA1 2876c72696471de56095717837810b626259771e
SHA512 5b05644e8a400386390b92efc89c22495130e7f4dad747f5e3c692d67929f9a5c56d926a0e8b1d64a51f90ce47fe150c2ba15d920e85d9d59d63d8b8edacb96d
SSDEEP 49152:vhtSn8EApI0figngiDn0AP5wRkS/Su37odjIv:+X2iyphmDFU1Iv
TLSH
T1B495BE13F2D900E8D05ED174C7568632EA62BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 24929231e8cb1d2a95633584fe8b393c6289578f8a286d530a142d6deefac180
MD5 249ba8145685d9a38e582fd8ab8e13ee
SHA1 379a65804cbd3a3513d4077bc038ffebc0a5a04f
SHA512 24ca18ea1debedc98d6b1e0026122aa30c2085f1a4ae8fb1ba3dcd1d14a7c17a933993dde465e062a9d4e3db95ff81c3558baee48fea2c87a3995dd0c05fbd31
SSDEEP 12288:u0lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:u0kS/SHOp17dadVZVyv
TLSH
T157652367B51A2C8BE383543096F400516168BEDBBBE029B96E6410772BFF1D1C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 7eaf2eb6a52c707f1e5f4d76d457b313b451d3c15cd8ea050036e742926eb075
MD5 8676546231e690bef744c894257eec69
SHA1 4a21edf8f697645b913bbd22bac1d1752cc5458a
SHA512 769ffc7752092520900d4133e8cdba09fa93af4cc658e7077361e9143b2ef9549d159ce4d064b3239a3ebbffb82baed07935a32760efa5cee611803248234993
SSDEEP 12288:nflms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:nfkS/SHOp17dadVZVyv
TLSH
T157652367B52A2C8BE387543092E400519164FEDBBBE069B96D6410772BBF1D0C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 3705a23c6301170bf0c324b302dd71e4645a512c90e4cf0c73ad65c7fe1345d2
MD5 88728980d45d1fb510fc5fd4bc441f2c
SHA1 364aa8fc4f0dc66d535f377523afc381897f3937
SHA512 aa704f43c12e7ea1458a67837a97794520d851efc52caf9a0c52f12e2309088b7d5012bec075073fa230b4993a4db5b2c2d46222cad33feefd693388e54a424b
SSDEEP 12288:SFlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:SFkS/SHOp17dadVZVyv
TLSH
T1DD652367B51A2C8BE387543093E40091A164FEDBBBE029B96D6410772BBF1D0C9971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 afd75fbe3a270851654a4e56f4f7d542e0ad58b5eca90309b9a5be07b109412d
MD5 ae644cc4b0dfa4197b02a46d1e59bb78
SHA1 287c0dbe369f1017815c4cfdb642347725985da3
SHA512 a5c613dddcc8ea19f6a0240d5edb1f20326665b9d2a4a2b57c0a56add4ac637b8a541c0f71a8e0215f614d04602431b834667e000fcdff8a2681c7eea183ce80
SSDEEP 12288:WVKlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:jkS/SHOp17dadVZVyv
TLSH
T124652356762A18C6D2839030C6F44051E2B4FDD6BBF06AFF5E50106B1FBB2D0D8667EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 4cc721f3dd963adcbe1683489c8a98c6c7c98c967a91028b4231794e47970f9c
MD5 0cbe515a83c8823db4705f6362a6ad3c
SHA1 2fd815e581c8bc46bd51dac149a7742a4af242ac
SHA512 8b20903fb8257f94f2ad7a89e40c07fac336861a8d11c03ea174cd6b3027ae763bf7518c31d7d1837d4584437defdf031ec0a9e830fcab36768138b387064ef0
SSDEEP 12288:NClms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:NCkS/SHOp17dadVZVyv
TLSH
T116652367B51A2C8BE387543093E400A16164BEDBBBE029B96D6410772BFF1D0C9971EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 269fc9cb36cc20e1df51479b3e68ab96166c577d9e94b8d555616db6e29e8449
MD5 62bd0d6b30424970ec10ef8155b77c4d
SHA1 d25391f782ee104ed32134d5e1add9323d9fb722
SHA512 faa5c8d649fc9d36ae014bec3e1e4f4cc2a7f0f7ae351182518cc645c020c58483d00d14adc41fbed786b84a73b483b99f867379e9519a397b9006b7ebcddfa3
SSDEEP 12288:uTlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:uTkS/SHOp17dadVZVyv
TLSH
T189652367B51A2C8BE387503096E400916164FFDBBBE069B96D6410772BBF1E0C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 639b379b5b106043d6c966ae013434fcd8812d611dd8456218fc37a80a277580
MD5 4e816ecce1b5f72abbe5889d224a1e0c
SHA1 71346d8e3996c9f502f4cd80c8c3e7a012da1881
SHA512 5c3d83d0acdfa7186b16b6fa05c6065d2700147aff9adb91d04c86dcb980a9471a1d26886568d5c78c3e93981ddaa84aa280daa16ee20221b9bd21d32a262a83
SSDEEP 12288:a3lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:a3kS/SHOp17dadVZVyv
TLSH
T107652367B51A2C8BE387503097E400615164BFDBBBE069B96E6410772BFF1A0C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b4023d9fd7f7b18d0344df87e916c68b0ef6261f09687e7c7bc54444adf81825
MD5 cf1696687b13c3eba1817b66152fea5e
SHA1 d3462f5f92c43543f61c9d4352e8a4d192f42709
SHA512 0305af3e81d040d76f023d2b01092d7454f41d2e8122f5be29ef403c0b544c3635d03c015cc596b639128eaf64ad062f32e9ce9b0fc8240c8b3722ace81e6cc0
SSDEEP 12288:9iZwbpzzFEoS2cPvy/lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:AZMtzFVSO/kS/SHOp17dadVZVyv
TLSH
T1E0850295B3501CF9ED63813EC9654806D2B27C5A1BB0CA5F07A432671F773A14C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5221d9c31e5da0a846c217bdb52cb330306d3de42e03e6bca2b0a63ae410f392
MD5 ee14863fd89bcb7685079a864f352b4d
SHA1 25a2fa3dd00b3eae3e4ba9d46ab7c2628246e0b8
SHA512 63135534eeac1551fcacab569dcafb7528e428027c02f1c6f2bab15572b3d121d0710a8b3eba389b6f554ebd8b773bf874e25fa4bf372c69d2bde21df24e8bec
SSDEEP 12288:awlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:awkS/SHOp17dadVZVyv
TLSH
T1DF652367B52A2C8BE387543093E400515168FEDBBBE069B95D6410772BBF1D0C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 296735cb828d25396e528eb0bbe04a44d370d84aa0a71635b3eda051a8375e1d
MD5 3d72533d2cd84458ce4f5bd2eded5cba
SHA1 b86834452aa9650874512fe5df2275749f28e42f
SHA512 456562e414cee6f0b2ab08d38c56ec25f46d2887d0d068fec6113b16ffd4c875bbc8aa930d68c3d819d0e358958be9eeae08a1ecf3caea7d329e0ee17455d057
SSDEEP 12288:Bclms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:BckS/SHOp17dadVZVyv
TLSH
T1C6652367B52A2C8BE387503097E400615168FFDBBBE069B96D6410772BBF190C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6139ab6cbe07c2b409ae226a9c900b5e87630986792af1f72a3023858694a43a
MD5 389baacf126c07cc154a85a2edb252a8
SHA1 6338067835234ac302dfbfb02c0a219b975c7189
SHA512 fc2dee0103d2202e61877246e9e9167995e1c419157b86154c74797629d5f1f856e7e7a1270cabfffb3d542b9dbcfdb752249c3f3ebf9f310e11446326cd3fbb
SSDEEP 12288:3yPz5L87lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:6zy7kS/SHOp17dadVZVyv
TLSH
T175750217736530E9D2679134C9A10912F371BC765BA09EAF1BA0027B2F772E09E3B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 31c5aa678c2923cc675d382894fb4e7c504c14e37cd90edf6c620d9705b84efc
MD5 aa783b67e1f1cc85adbbecb134631251
SHA1 6f0742ddb45c4fd17ddebc0c1d43c5c72fd94ea4
SHA512 306de817d6806a85900d3c3e09de5776584b0c331a21ca1515c75b2701e80cd5cabeeae9411d9dd602efa7b808d5b7807d2cc4f25a91fff2fd5fb85e2a68700c
SSDEEP 12288:7wlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:7wkS/SHOp17dadVZVyv
TLSH
T1DA652367B51A2C8BE387543093E400A19168FEDBBBE069F95D6410772BBF1D0C8971EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 f770ac037fb8a2ee854ad9a2b9359e5674acb4cd78e644f08c7ed8c274c523fe
MD5 0a383641164a46183b45ed8964c68239
SHA1 2c52746f36daea230b2a0dd5ae50722b87750e67
SHA512 e131894cab4d86e7e803ea90f4bfcd1c389cae5eeea299f8b19a5d1d47e3abcb4499e640ede444c95cb81e21a6afb7f50cfbf431bf3459abe34a772dc28ea59f
SSDEEP 12288:Jwlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:JwkS/SHOp17dadVZVyv
TLSH
T15A652367B52A2C8BE387543093E400A15168FEDBBBE069F95D6410772BBF1D0C8971EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 d0618f98ecfff3aa904761690cc927705a796cac68d1593266045baa183e00d1
MD5 3bb518f4d7260f56b16895d1043ecc75
SHA1 9a82cf2ed68b9bef1e7e06bd6ca709f13adf2d08
SHA512 1ad26c9d7641b3b591b808c7bd5a7bc120ec50fd149209490aa443b338dad0051843cfe65bf04b7a8f18d02aa9f0b3cbfccfe1c8b4f03b191420f98625a2c29f
SSDEEP 12288:/yPz5L87lms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:yzy7kS/SHOp17dadVZVyv
TLSH
T1F9750217736530E9D2679134C9A10912F371BC765BA09EAF1BA0027B2F772E09E3B761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4a72ea864fff84883c305df99812ab0c6fe75a17ddb037f0907d4c7210fc488e
MD5 18ed4b9125b84341e89fef4f5ae2b884
SHA1 699c7dc970b8d7facaaa677f220e7e4c936837ad
SHA512 dc2de39a3209d525c4235f39bfc323cad3d0416501edd324e0e1eed38b2d01885df4807e0be4f295437e76cc6ba8ab7dc4a1407f23f208c16167a0910b94daec
SSDEEP 12288:CCd9/WYoaLHF3z0z04PDvhVlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:DTWaLl3z0zDVkS/SHOp17dadVZVyv
TLSH
T1B18502A5B3501CF8ED67813EC9654916D2B27C5A0BB0CA5F07B432671F373A05C2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 0d7b638272f886cab9a75f971b373152d972705c81ac35b6726c8be586e0a971
MD5 e7991e59a556c367ae2e5f21689a9f72
SHA1 5383202506b6fca7e9343c1963a43c40211e5091
SHA512 b4af93002b79dbab93ab2f8875c802f9e87e872be994667bf9121fdfb93d2e4cffc365f3f8f247037164981ffcd42806e243958127ab59961f673ce750044eda
SSDEEP 12288:Yi4e7xRdTfgwCHKy7GLbbdIvWlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwf:Y3Sd9CHKy7GZ5kS/SHOp17dadVZVyv
TLSH
T18395CF90F3E414E8F1B79A35C9764511DAB67C9A1B70DE8F03A4252A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 2fe590b96d73e455e2e0dfa5a4343b506dc80a876abc2c273924fbbc28869f5d
MD5 6ec517dbd68996e058ba5eebd2520303
SHA1 0bed1f729f3fc7102ae05549116e55480d8db8da
SHA512 e3bbcfb9a0c602166dfbd364f6890002095d358dba46c8a89f72fdd0ad4b9f10f0dc5318bbdc19b8b949f5b6c0dd461dcf869773b6e88b65a2f5873ec4faf18c
SSDEEP 12288:fllms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:flkS/SHOp17dadVZVyv
TLSH
T113652367B51A2C8BE387543092E400A16164BEDBBFE069B96D6410772BFF1D0C8971EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 55c0792631e4777fdebed0274cdf53c262ee86f38ce11deafe1be8af16de6fd9
MD5 ac33dacf6fad56c9f89de174e58f6b86
SHA1 fffbd7a7ed60e47467478e1b74408f968a1a26cf
SHA512 5194031908ed690c59668632271096f5354fdb9d3d7499d55543ad21eaa5113828c13fb9e1d1c0418a4a2088b36939ca51ec1c021c67507bb7f535dd2eaaf6c5
SSDEEP 12288:Qblms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:QbkS/SHOp17dadVZVyv
TLSH
T1CE652366B52A2C8BE387503052F400516164FFDBBBE069B96E6410772BFF490C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 d676b31e6f9aaf1d654774b34b7f9025398251e439ac790410991d79c0ae26f0
MD5 06e4efe52adc816818a7b5df669060ba
SHA1 331b01e6b4c2a3dd44588895d99d03873482c72c
SHA512 13d7bd87977a474413dde84acf9c8a8494583a2665c1fd7dbb9b0a8959eb8acc900836df27fe9bdc3f4e4b1655dca40ff06b580cf20d80bb78624da624d0ce84
SSDEEP 12288:QWlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:QWkS/SHOp17dadVZVyv
TLSH
T1E7652367B52A2C8BE387543093E400A15164FEDBBBE069B96D6410772BBF1D0C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 59a4e522c475f9bc6481469b66d61d1aef813e49e77614fe8ece07853eae456d
MD5 6a6965b0cff8a186da20d2f936e85773
SHA1 0f7de095b697bacc0bfa09b244e97fae1d9ab441
SHA512 7c861c9a7906b868b42b8357451405f7c554c3a50f39dd1ebf389983ce9475401dbb5ac5f0455ffc2de4070b790a08f77a6476a3ac5f4f9036aa9a33b1349123
SSDEEP 12288:Awlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:AwkS/SHOp17dadVZVyv
TLSH
T15B652367B51A2C8BE387543093E400A15168FEDBBBE069F96D6410772BBF1D0C4971EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 4ab1eb52bd02a8617bfc7a9cbd5ff69fe8f77e2871521ddaea326b03e1cad9df
MD5 a8945a27b4293e59213fd02443002227
SHA1 0ea000c8c3f4310cb3d2da60681612c4a91546d9
SHA512 0b94c9fd55db4dd4001e70b0b7560df5057d0316d16fa2432f209c2d98ead1aade1f917f721c670cccc207c87ad8878e6ec8611a96ec1f5f1dd8b43d0a19cb79
SSDEEP 12288:Jllms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:JlkS/SHOp17dadVZVyv
TLSH
T118652367B51A2C8BE387543092E400A16164FEDBBBE069B96D6410772BBF1D0C8971EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 75629fa9a6fb366445c721aafcad5f4af17664c3e92e431787c7bf7e0de6c260
MD5 166a76e0a68151cf8f6d9d28c8f2f400
SHA1 2fda403ae96c66051567ce500312de6e577c2c78
SHA512 515401dd1f77cd388451e2b83a5fcfefc609b7ba3f0788c2b64489d8de835d8d58f82b591522b45ee7ff592fd4cc1dd335115bc3798290972d4970e19077dea4
SSDEEP 12288:pIlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:pIkS/SHOp17dadVZVyv
TLSH
T1FE652367B52A2C8BE383543097E400619168FFDBBBE069B96D6410772BBF191C4871EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f76b87758a2d5bc4e4c085c888503b2fe2abb80996692fb16b825cbdabc24a5f
MD5 6a77ab57b2409681220f95bb37d918d0
SHA1 67505f6a3f48f1a5fb9e62185f8eab982a4d63c8
SHA512 666aef4354d9829b8999a35111b7fd29ed93c0099c9c1baf8ce2cb97c150dab8c48d8a7f8a4a577a059e13a16003ef70de542a76de3d94d099115d085593836d
SSDEEP 12288:8Clms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:8CkS/SHOp17dadVZVyv
TLSH
T161652367B51A2C8BE387543093E400A16164BEDBBFE029B96D6410772BBF1D0C9971EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 f279e1221cbf7fe95a19424bff09a294c04e314e04e913d57ad4d406e610515d
MD5 554adb42a6116f0b3b7a22c7f5045b64
SHA1 eaa2d5a59ff3e0209dbdecd4947cba7c12e0da79
SHA512 7761e5a49840a1c3e817b8833d517921d28d42f7aee21085a4e17187877e594305923de0d0fa045de9b9d2293ae46d4989f8f02d30ec1f0a10008445277f053b
SSDEEP 24576:ffwvuk9RX6wkyAIMkS/SHOp17dadVZVyv:fMnYIMkS/Su37odjIv
TLSH
T1F395DF29EBDC04D5E1B7913C89B7460AF2B178691B71C6CF025A53AE0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 22966a6adcc0d13a931747824c63817e81e3fae35420406837df63b394400f70
MD5 575ccad553692fcc4600f87dd3db4958
SHA1 c845aac4ea5695acc2d158ba2cd89be022525d91
SHA512 8c9e0f84ce1ca0d13c4ed2200017be2011645fd24fc42ba2d6b7756d3e8f1bcf10ed4560b26eb542d28474bcfdf537b79ed546c3901b524f93239b82dc3f1bb8
SSDEEP 49152:xYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xkS/Su37odjIv:ZySzP5DFU1Iv
TLSH
T1E0067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556931F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7cb313e7f19ef48df2c3c714943b4784a3eae4cfceb542cb283a5f71d30028b0
MD5 cd0cfc759b2b39e5b24ad1af1aa5a0dd
SHA1 c490e75d7925bd896cab37d5829e326e626c1828
SHA512 34f751a39bfb517b88ca1497da8fe31afa7442df38f049977a4af76508af3f5bd5d5c7032710b04b554c4f081d2b55f9209c799f44bcadb2070dfd5035015271
SSDEEP 24576:247Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvkS/SHOp17dadVZVyv:247JUQj1irIhCnDHUPfF/hkS/Su37od4
TLSH
T11565AE1EA3EC01D5E1BA927885554A5AEA71782E1F31CACF1270437D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 b84a72b0001424d5ffaf839025f44babbf445d7b94ebb8394e5834d1f042cc89
MD5 813724ef50e09074831729fe0f4dbd10
SHA1 780ad00d0ed8b11d2584c74fd2ff3f41d2a6e222
SHA512 994f0c312e51599955f070c45d503e55069257cc58d8484f667ec271243591f6eadc70cfe9e90790249b344d2de631c152f719871b449f21bca0a697c7c00980
SSDEEP 12288:GusfAlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:uAkS/SHOp17dadVZVyv
TLSH
T15A75011AE25811D9C1AE6035C7A54A41B3337C66A7E0E3CB5AD0F03E1F7A6D09DEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 b15cdf15d61446ec389765d2f715e4ba533d72744c2afd435379cab736ece592
MD5 4fe3c69f4a9cc384cefd4e8be280f397
SHA1 09aca78c4b710fbfd904d749a90f82597b35a49b
SHA512 679e770a9148b0e12c9fc153fd89a5d07c321f7265147e0a8482dd82a933c4fa1b75368ad6f837bbc594948b20df346452355e2b3579c49fdac07466b305259d
SSDEEP 12288:3RlBkOU3fM6oN9gDbTQlDqy4j/bV2Nnj5lPX0xLLJXpDCJ6ycp:3RlKOUPuHubkcyaz4NdkxLLJXpDwcp
TLSH
T146452841766AC74FC6A940325E32D1CCAB707C11EE056F0773C98B3FD576668BAE6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 88677da4498c16f059e553fec18bb580b78a234abe461904e3e3462dd6613a9b
MD5 ede0aee28653ba06310b1257196d23d2
SHA1 17a18a75195b4583193eea8a9ed339c9bbc49c43
SHA512 e68df90fb79918cd0edb7eed704f9851a2720a2ddbc58d7e5dd9392d547a77dd4d47a93186341182df64056bb3cbec8666b7ecca091485bc2f84dd3e6c378aaf
SSDEEP 12288:aHDS9gazE5hgZrYLZdiyzVFJ/5lY0/FaMsuNk:aHDS9gaSLd/Dl/iu2
TLSH
T15465F9815537E38FD5F7203207295B4CB7A4EC46B7096F26B388453AD826B25A4FE3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 cf427a3a677203a99e1e115aebce28436f0057b27e02ff565f6244ac935549cb
MD5 26a9d5c9047e683211ea572877906329
SHA1 886b5bde6eac12018240af05c41da6a148b26d45
SHA512 bbf1628e78961d2f2e248c5f31eee21211081b136091a34e71b1660180d221167f1e3c9ee18871976dda0547560fa7c794e33482de25d5670edc0753e3e7e5a4
SSDEEP 12288:887Ylms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:pYkS/SHOp17dadVZVyv
TLSH
T1E6652327B2192C47F397543056E840316128FEE97FD098EBAD1411AB2ABF5D0CDB629F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 097a811fc3f53f3c5508e4a501edc36b83e073f124dc8bb184e49cfc32b81b38
MD5 1445e8d0b0ee9fb780f33583bddbe0d6
SHA1 cddf17feb6189afd0af02b4cb188000a9eba282c
SHA512 0ab96627cab9d840a77bb05644be1bb4e42535a49ed80a4360cb794357f27c827c7fab79d722af75ee6b8d25e25572ec72bbb015098a78b9d93924d1d64b335c
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYekS/SHOp17dadVZVyv:Qgb4mBIBhGFvkS/Su37odjIv
TLSH
T10565AE1E22EC01E5E0FAE2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e889146adef45d3ff9960a453b5bc5d39a23cb309b6bcc2da1a3b5df92f323e1
MD5 611f5f17c5d3d530f656bad586f31ba0
SHA1 05d98750079d3e92db5aa5627bed95eb01596cda
SHA512 b668b42c374e22a03830e3fb89698af2642d577b6aa2e1c0c83a51645dbc4959a318b8fc77dd1d4ffee5d770270450b8abc720fb6f83bdf4bf7dbc95b89436e8
SSDEEP 24576:EG88u8FpJqH16zria7/m/kS/SHOp17dadVZVyv:37ZFPqVFa7/2kS/Su37odjIv
TLSH
T13795F16576E101F1D477D0388A864663F2B1B8251364EFDF0BA88A561F33AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fd516709ec04c5410d20d67649727da3fe8691c3f018137a17310b603497f67e
MD5 6d5e531fe3dfb5992283168c4a8e41a2
SHA1 1d1cb2f61beda62ec2b67dfb69106f25eddb65f4
SHA512 5ef799246e6a0654f6c9e480ae1c003536e9d749aedb6c49291374bfe4a40e60a02b6d89b2cf5effbc959842c5a01a425b15edba2f5a406f7d2ad260df0db374
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTkS/Su37odjIv:lG05lO43bkDFU1Iv
TLSH
T189D5CF6A62EC11F9D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 332953eeed9d5e82882809474ae4f0219cd26d2b0a99d1bcac9b3fdd6cd8e63f
MD5 cae417fa1e7d5f016d2114ea6fac7985
SHA1 069b9d5bf449dffc2e4f42097a4f6ea6d079bcd7
SHA512 354add6910839d05380dd1500f5a537d4f8da14a2fe15c7e5afa58bd7f08edc2f9541ef432ed857ca5aee31f658e11ea22eaea008dc7d2104abba4f4f63f2086
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnxkS/SHOp17dadVZVyv:qa5POZ3+Jt2pasx2+mbkS/Su37odjIv
TLSH
T19665AE5EA6FC00D5D1B9D17DC583861AF5B1346653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 65062e7a21c92bc109aac96d7effed8975910c2adc244f42448ec2a6ed60a8a9
MD5 abcf6d803a135b79e6c5466f6674901f
SHA1 131211ee50497e495a183218eb90559327fc63e9
SHA512 711d2ae1898d4c959cf2dc6ffe8942cc68b92ddd8bd66c9f1fc139fb764cc83e7017e884d211597236e57e8d5fac944470d2e7d03067ea13bb11479b9e4400f7
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkHkS/SHOp17dadVZVyv:1Nc/zEOVHFWkS/Su37odjIv
TLSH
T164857B2623E901E4F1BBE1BE89779546FA71786557308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bc210f247822de39d971e6a1636314ba70eb5474ad7f67312a6d7f1915a9f71c
MD5 60cd98a09a62fa12dbd85d45a53e1343
SHA1 c51778f55cd1b9cacecf4ab38571e9585eaa4ea7
SHA512 8aefd551d1fe61779bb365b79cfd2df17f5b8846dfcd39f6c8c9e065ce8d0328aa4f31c63bed83c2851110d09a19566af1f75e177149063337717ce32885d73b
SSDEEP 24576:38kNvNnaFeYhJNtmZBmtkS/SHOp17dadVZVyv:38MwBtOmtkS/Su37odjIv
TLSH
T1BC55AF6EB6B805E4D1FEC6B4CE238512E6727861173293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0c1b0e9c8b5db981091cdd664506b7eb1c424cf16f6d49225fe350821948f4a4
MD5 ce456d83580b43efe277374e1cb37964
SHA1 11f1eff6d07fec904a4607e2b5d90479812e4064
SHA512 516dc978b3601ac1e846abd8aa75662de19171e7cdb311bf78a89054f8ddce8ce34c40ede47b859855e84b8e3d4963316640a8db1aabd7f9e3aecfff7ebdd1bf
SSDEEP 12288:nHvUrBFrEjwaQDlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybfwXv:nPUr+NQDkS/SHOp17dadVZVyv
TLSH
T16675E12F72AD1CD5E676A03C85824619F371B862175196DF02E0817E0F77EE8AC3EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 6cf84ec6d04dd68e146abb59e5e3a39f80b494cd412050e7585257841fad2fac
MD5 30aa4ad8ed03517a96f80199f1907361
SHA1 3279d3a8c9be4561d3d9b681df04e30f87430bc8
SHA512 f32c02807afb5c2189e69bbaf3ca09ab9711ae22406797ab6e6ab3d47a10e52fa5e4be1829af3e34873361e6dfeba1e54fa580e6acca8120251423865a9e5d48
SSDEEP 12288:kQcMxWDXN1Dp/fshBItT1IQgAUlms7vWCULmSHyhp1mtbg2CSovSoC8gZkl3ybf+:+D3FHshBIYQgAUkS/SHOp17dadVZVyv
TLSH
T11385F13EE65C04E4E57BD17CC6A38906E37138A9033169DB06D481BA1F6BEE46D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/872-313-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/872-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/872-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1980-307-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1980-81-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/1980-75-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1980-76-0x00000000009D0000-0x0000000000A37000-memory.dmp

Download

memory/2504-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2504-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2504-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2504-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2504-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2672-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2672-125-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2672-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2672-133-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2672-131-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4328-44-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4328-37-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4328-48-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4328-38-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/4328-50-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4396-53-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4396-59-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4396-52-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4396-291-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4824-65-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4824-306-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4824-63-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4824-71-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5668-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-324-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5668-92-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5668-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5668-86-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5880-19-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5880-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5880-12-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/5880-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6384-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/6384-18-0x0000000140000000-0x0000000141736000-memory.dmp

Download

memory/6384-103-0x0000000140000000-0x0000000141736000-memory.dmp

Download

memory/6384-6-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/6452-105-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6452-308-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6452-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6452-97-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/6452-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6924-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6924-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/6924-312-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/6924-111-0x0000000140000000-0x0000000140211000-memory.dmp

Download